I have a sourcetype which has data telling me if something goes offline and then when it comes online.
I am trying to write a search that only shows the most recent offline event where a newer online event has not yet occurred.
Any help is appreciated!
... | streamstats count(eval(action="online")) AS sessionID BY host and other fields here | stats count dc(action) AS action_count values(action) AS actions BY sessionID hsot and other fields here | where action_count == 1
a sample of yur data could be useful, but anyway you should select the conditions, e.g. having:
you could run something like this, if it's relevant the duration of offline (e.g. online must come back at most in 5 minutes):
index=my_index (status="go offline" OR status="go online") | transaction user host startswith="go offline" endswith="go online" keeporphans=true maxspan=300s | search NOT status="go online" | ...
But it's a slow search (transaction is a very slow command).
If instead it isn't relevant the time between offline and online, you could run something like this
index=my_index (status="go offline" OR status="go online") | stats dc(status) AS count values(status) AS status BY user host | where count=1
Thanks Giuseppe this is very helpful! I do realize a sample of my data would useful, it is just tough to do so since I am in a disconnected environment. Basically it is as simple as Host, TimeStamp, onlineStatus. I do not have a username field, nor do I (at least at this moment in time) care about the duration of offline. I just want to know if an offline has occurred without a corresponding online. Your second query above looks like it would almost do what I need! However couldn't that query wind up showing an online event depending on how the timeframe of the query was setup?