Splunk Search

How to create a search to find offline event that does not have a corresponding succeeding online event

Path Finder


I have a sourcetype which has data telling me if something goes offline and then when it comes online.

I am trying to write a search that only shows the most recent offline event where a newer online event has not yet occurred.

Any help is appreciated!

0 Karma

Esteemed Legend

Like this:

... | streamstats count(eval(action="online")) AS sessionID BY host and other fields here
| stats count dc(action) AS action_count values(action) AS actions BY sessionID hsot and other fields here
| where action_count == 1
0 Karma

Esteemed Legend

Hi dglass0215,
a sample of yur data could be useful, but anyway you should select the conditions, e.g. having:

  • an index called my_index,
  • a username field called user,
  • an host name called host,
  • a field called status that contains different strings for offline and online ("go offline" and "go online");

you could run something like this, if it's relevant the duration of offline (e.g. online must come back at most in 5 minutes):

index=my_index (status="go offline" OR status="go online")
| transaction user host startswith="go offline" endswith="go online" keeporphans=true maxspan=300s
| search NOT status="go online"
| ...

But it's a slow search (transaction is a very slow command).

If instead it isn't relevant the time between offline and online, you could run something like this

index=my_index (status="go offline" OR status="go online")
| stats dc(status) AS count values(status) AS status BY user host
| where count=1

that's quicker.


0 Karma

Path Finder

Thanks Giuseppe this is very helpful! I do realize a sample of my data would useful, it is just tough to do so since I am in a disconnected environment. Basically it is as simple as Host, TimeStamp, onlineStatus. I do not have a username field, nor do I (at least at this moment in time) care about the duration of offline. I just want to know if an offline has occurred without a corresponding online. Your second query above looks like it would almost do what I need! However couldn't that query wind up showing an online event depending on how the timeframe of the query was setup?

Thanks Again!

0 Karma


hi can you please provide some sample events and desired output?

0 Karma
Get Updates on the Splunk Community!

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...