I have a console application on the forwarder which monitors the services running on that machine and forwards the responses to the indexer in the following format -
Following are the 2 questions I have -
1. I want to show the response in a table format with HostName and Status. I am just getting the 1st value Host1 always in the table rest values are not populating on the chart even if I search by just sourcetype. Can someone please tell me how to parse the field so that I get all the HostName.
2. Based on the status "Running" or "Stopped" I want to show an image on the chart, is it possible? If yes, then how can I do it, please suggest.
Please note I plan to present the above scenario in views.