How to create a search for the dashboard to show last event from each source?

[ng87]

We have an index that reads in log files from disk. Each logfile is its own source under the index, I want to create a basic health dashboard that shows the source name and when the last event/log was received and in the perfect world turn red if the last log was received more than x hours ago.

I currently have this set up with a single dashboard for each source, however, I would like to try and consolidate into a single dashboard.

Any help would be amazing

[adonio · Accepted solution]

maybe a single panel will do,
try out this search:

| tstats max(_time) as last_event where index=* by source
| eval last_event_human = strftime(last_event, "%c")
| eval now = now()
| eval diff_in_seconds = now - last_event
| eval alert = if(diff_in_seconds>10,"alert","OK")

change the index=* to your index
feel free to change the alert value (here 10 seconds) to your desired value

hope it helps