Display sources which do not have a string

[nbk7e9d]

Hello,

When I restart a large application with hundreds of processes, I can see a string like "startup successful" from the logs.

How can I display a list of host and sources which do not have this string?

host1:/a/b/c1/file1.log
host1:/a/b/c2/file2.log
host1:/a/b/c3/file3.log
host2:/a/b/c1/file1.log
host2:/a/b/c2/file2.log
host2:/a/b/c3/file3.log
...

Suppose host99:/a/b/c13/file23.log did not have the "startup successful" string. How would I display that?

[kristian_kolb]

Proving the negative is a bit harder than opposite. Assuming that all of those files are of the same sourcetype, one approach is to use a simple subsearch;

sourcetype=XXX earliest=-15m NOT [search sourcetype=XXX earliest=-15m "startup successful" | dedup host, source | fields + host, source] | dedup host, source | table host, source

Set the earliest time at the time of the restart, so you don't get irrelevant older events included. In this case I gave the application 15 minutes to startup, before running the search so-to-speak.

/K

[nbk7e9d]

The double negative type question is confusing me. 🙂 This search will give me a table of hosts,logs that do NOT have "start successful" message from the time I choose in the TimePicker.

[HiroshiSatoh]

Is not output to the list if any (host log is not output) host has not been activated within the specified time that it is the search is present but OK?

[nbk7e9d]

Since I'm selecting a custom time from the timepicker and my sourcetypes aren't exactly the same, I used:

host=host* sourcetype=logs* NOT [search host=host* sourcetype=logs* "startup successful" | dedup host, source | fields + host, source] | dedup host, source | table host, source

This works nicely. Thanks!