In my server i have 24 jvm. if the jvm is down .i need to trigger alert in splunk?
i have to trigger alert whih jvm is in down state
eg:server name : va20n5445
Are your logs in Splunk? What does the "down state" look like? A general search like
index=myjvm host=node* | stats dc(host) as hostCount by host | where hostCount <24
You can do a simple time search over last 5/10/20/30m or whatever time range you want. This will give you a count of hosts during that time < your total number of hosts...
Theres alot more options, but your question is very vague.