I have a host and source.
host="xyz" source="abc"
They give me results every minute whether the connection is up or not. My question is how do I write a query that continuously keeps checking the connection every minute and shows up if everything is fine and shows down if there is a connection fail for greater than 5 mins (i.e. the log would contain the connection is down 5 times)
Makeresults| tstats max(_indextime) as recentTime where index=* by index host source | eval age=now()-recentTime | search age>60
I'm not sure I understood that. What is Makeresults?
Make your results 🙂
Index=* host=hostname source=sourcename| above query
Oopsy. Got it. But, I was getting this error: Error in 'tstats' command: This command must be the first command of a search... So I thought, that was something. 😛
I still don't get it. Even if I try using simple stats command, it returns index error
| makeresults [| tstats max(_indextime) as recentTime where index=* by index host source | eval age=now()-recentTime | search age>60]
@timmag this sould work fine
You can use | metadata type=hosts
and then select fields you want and apply condition.