Help with advanced search for matching entry?

[RobertRi]

Hello Community!

I'm searching for a solution to highlight the "HostC", which has an AppC failure and no further log entry, that AppC is started again.
How can I do this, regardless on which host this happens?

I saw a comment, to create events for "app failure" and "app started" and then make a transaction,
but is there an other way too?

SampleData:

1.1.1970 08:00 HostA -
1.1.1970 08:00 HostB AppB=failure
1.1.1970 08:00 HostC AppC=failure
1.1.1970 09:00 HostA AppA=started
1.1.1970 09:00 HostB AppB=started
1.1.1970 09:00 HostC -

Thanks for your help
Rob

[yuanliu · Accepted solution]

Several possible approaches.  But the simplest seems to be to just look for latest app message.  You didn't illustrate what you mean by "highlight".  So, I have to speculate that you just need the name of host and application which had this kind of orphan.  But the biggest problem is that you didn't say whether HostA, B, C are values of a field (like host?), and whether AppA, B, C are values of a field (like application?), and if keywords like failure and started are values of a field (like status?).  Assuming none of these fields (except _time) is available, you will have to extract them first.

| rex field=data "^(?<timestamp>\S+\s+\S+)\s+(?<host>\S+)\s+(?<info>\S+)"
| rex field=info "(?<app>[^=]+)=(?<status>.+)"
| eval _time = strptime(timestamp, "%d.%m.%Y %H:%M")
``` extraction above ```
| stats latest(status) as last_status by host
| where last_status == "failure"

Is this what you need?

[RobertRi]

Thank you! 

This was the solution! 👍

| stats latest