How to display a message in dashboard like "PROCESS IS DOWN" when certain events showed up in log?

[krishnacasso]

I want to display a message in dashboard like "PROCESS IS DOWN" when certain events showed up in log.

"sm waiting for threads to terminate" OR
"sm proceeding with shutdown" OR
"sm is down" OR
"Thread pool stopped; proceeding with shutdown" OR
"Released sm"

If any of the string when occurred in log, I want to show a message like host and Process is down.

Thanks!

[aaraneta_splunk]

@krishnacasso - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post. If no, please leave a comment with more feedback. Thanks.

[gcusello]

Hi krishnacasso,
try something like this:

your_search "sm waiting for threads to terminate" OR "sm proceeding with shutdown" OR "sm is down" OR "Thread pool stopped; proceeding with shutdown" OR "Released sm" | eval Message="PROCESS IS DOWN" | rex "(?<Error>(sm proceeding with shutdown)|(sm is down)|(Thread pool stopped; proceeding with shutdown)|(Released sm)) | table _time host Message Error

In this way you show TimeStamp, host, your message and in addition also the Error String you found.

Bye.
Giuseppe

[cmerriman · Accepted solution]

....|appendpipe [search "sm waiting for threads to terminate" OR "sm proceeding with shutdown" OR "sm is down" OR "Thread pool stopped; proceeding with shutdown" OR "Released sm"|eval newMessage="PROCESS IS DOWN"|table newMessage]|search newMessage=*|stats count by newMessage|fields - count

I tested this quicky on my system and it seems to work.