How to create a search to find offline event that does not have a corresponding succeeding online event

[dglass0215]

Hello,

I have a sourcetype which has data telling me if something goes offline and then when it comes online.

I am trying to write a search that only shows the most recent offline event where a newer online event has not yet occurred.

Any help is appreciated!

[woodcock]

Like this:

... | streamstats count(eval(action="online")) AS sessionID BY host and other fields here
| stats count dc(action) AS action_count values(action) AS actions BY sessionID hsot and other fields here
| where action_count == 1

[gcusello]

Hi dglass0215,
a sample of yur data could be useful, but anyway you should select the conditions, e.g. having:

• an index called my_index,
• a username field called user,
• an host name called host,
• a field called status that contains different strings for offline and online ("go offline" and "go online");

you could run something like this, if it's relevant the duration of offline (e.g. online must come back at most in 5 minutes):

index=my_index (status="go offline" OR status="go online")
| transaction user host startswith="go offline" endswith="go online" keeporphans=true maxspan=300s
| search NOT status="go online"
| ...

But it's a slow search (transaction is a very slow command).

If instead it isn't relevant the time between offline and online, you could run something like this

index=my_index (status="go offline" OR status="go online")
| stats dc(status) AS count values(status) AS status BY user host
| where count=1

that's quicker.

Ciao.
Giuseppe

[dglass0215]

Thanks Giuseppe this is very helpful! I do realize a sample of my data would useful, it is just tough to do so since I am in a disconnected environment. Basically it is as simple as Host, TimeStamp, onlineStatus. I do not have a username field, nor do I (at least at this moment in time) care about the duration of offline. I just want to know if an offline has occurred without a corresponding online. Your second query above looks like it would almost do what I need! However couldn't that query wind up showing an online event depending on how the timeframe of the query was setup?

Thanks Again!

[Sukisen1981]

hi can you please provide some sample events and desired output?