It looks as if this TA is using macros to populate a lookup. So an example to mark a host "down" might go something like this ( = backtick):
earliest=-1m@m sourcetype=iis http_status=500 | stats count by host | where count > 200 | map search="<BT>mark_host_down($host$)<BT>"
Basically, you can funnel any string and have it populate a lookup with either up or down status.
Once you have the host marked, you can use the lookup to write reports.
earliest=-20m@m sourcetype=iis [|inputcsv server_down | rename server_name as host]| stats count by host
This will show you what servers are down, and their events.
To clarify: I did NOT write the TA, nor would I recommend its use. After looking at the code, it seems kinda "hackish" and doesn't use optimizations, provide much useful data enrichment other than "the server name is down" lookup, and does not follow Developing Apps Best practices (it has stuff in the local folder.....). Use at your own risk, but you might be better off writing something else that has more data enrichment (the server name with status [hardware down, software down, etc], first seen down, last seen down, resolved time, etc).
