How can I alert if this PID changes on 3k machines?

[daniel333]

All,

I have about 4k hosts collecting PS data. What I would like to do is get a dashboard or alert when the PID for SSHD changes. I really have no idea how to compare that many collections to their previous ones like that.

I got this far...
sourcetype=ps COMMAND=sshd PID=*

[xpac · Accepted solution]

I'd try something like this:

| stats values(PID) AS PIDs dc(PID) AS PID_count by host
| where PID_count > 1

Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂