Semaphores

[gcusello]

eed to show in a dashboard if one or more servers is up or down.
How can I do this?
I tried to create a search that counts the processes of each server:
* if the count is >0 the server is up,
* when the count is = 0 the server is down.
I would show a green pie when the server is up and a red pie when is down.
The problem is that when the server is down I haven't any log so the result is null and I don't know how to show zero
Thank you in advantage.
Bye.
Giuseppe

[gcusello · Accepted solution]

I used this solution:

| inputlookup server_list.csv | eval count=0 | append [ search index=xxx | stats count by host ] | stats sum(count) AS Total | where Total=0 | table host

In this way I have all the servers of my lookup that don't are present in my logs.

Bye.
Giuseppe

[richgalloway]

I use a set union of my search with a inputlookup of a CSV list of expected servers. This enables a server to appear in the results even if no events are found for it.