I have logs coming in that are the following:
State change from '0' to '1' is complete
or
State change from '1' to '0' is complete
on multiple nodes.
Basically, I want a graph/visualization that displays the most recent status of the hosts. I've used | rex field to extract the value either '0/1' on each log after "to" but I'm wondering how I could do it so that the graph shows the most recent state of each node, maybe a bar graph or something where a green bar=1 and a red bar=0, separated by hosts.,
Any advice is appreciated, thanks!
See if this helps.
index=foo
| rex "from \d to (?<state>\d)"
| stats latest(state) by host
See if this helps.
index=foo
| rex "from \d to (?<state>\d)"
| stats latest(state) by host