How do I constantly check the log if a connection is up or not?

[timmag]

I have a host and source.
host="xyz" source="abc"

They give me results every minute whether the connection is up or not. My question is how do I write a query that continuously keeps checking the connection every minute and shows up if everything is fine and shows down if there is a connection fail for greater than 5 mins (i.e. the log would contain the connection is down 5 times)

[splunker12er]

Makeresults| tstats max(_indextime) as recentTime where index=* by index host source | eval age=now()-recentTime | search age>60

[timmag]

I'm not sure I understood that. What is Makeresults?

[splunker12er]

Make your results 🙂

Index=* host=hostname source=sourcename| above query

[timmag]

Oopsy. Got it. But, I was getting this error: Error in 'tstats' command: This command must be the first command of a search... So I thought, that was something. 😛

[timmag]

I still don't get it. Even if I try using simple stats command, it returns index error

[MKowalewski]

| makeresults [| tstats max(_indextime) as recentTime where index=* by index host source | eval age=now()-recentTime | search age>60]
@timmag this sould work fine

[p_gurav]

You can use | metadata type=hosts and then select fields you want and apply condition.