I'm tring to do a search for some process for a server but I would like for those that are not running the result comes with 0, becouse in splunk the process when not running they don't bring any information:
exemplo:
index=os sourcetype=ps host IN (wmwl5000 , wmwl5001, wmwl5002)
| search process="launch.sh" OR process="WebLogic.sh"
| stats count(process) by host
What I wish to see is like this:
wmwl5000 launch.sh 1
wmwl5000 weblogic.sh 0
wmwl5001 launch.sh 1
wmwl5001 weblogic.sh 1
Cheers
@leonardomassardi
Have you tried this?
index=os sourcetype=ps host IN (wmwl5000 , wmwl5001, wmwl5002)
| search process="launch.sh" OR process="WebLogic.sh"
| stats count(process) by host,process