Splunk Search

How to display pool down on two cluster server?

elmadi_fares
Loves-to-Learn Everything
index=idx_rdap source="*f5*" "*member*" "RO1B4-0JLSM4000S" "/Common/pool_d2i_*gkrgkl"
| rex field=member "\/Common\/(?<server>[^:]*)"
| stats latest(status) as Last_status, values(pool), as pool_name, values(_time) as _time by pool, server
| stats values(Last_status) as Last_status, values(server) as server by pool
| eval severity=case(server="XC001X02" AND server="XC001X03" AND Last_status="down", "1", server="XC001X03" AND Last_status="down", "3", server="XC001X02" AND Last_status="down", "3",true(),"0" )
| table pool, Last_status, severity, server
| eval hour_of_the_starttime=strftime(_time, "%H")
| eval support_group=if(hour_of_the_starttime>=19 OR hour_of_the_starttime<7,"WW-XX-TFORMEGI-L3", "WW-XX-MSEGI-L2")
| eval ressource="GKR-GkL-I:" + pool
| eval service_offring="GKR-GkL-I"
| eval description="VIP GMS got a service status down \n \nDetail : One or more legs Impacted service on :" + pool + "\n On server(s): " + tostring(server) + " \n\n\n\n; " + support_group + " ;KB=KB00000"
| table ressource description pool service_offring severity server support_group
Labels (1)
0 Karma

elmadi_fares
Loves-to-Learn Everything

someone can you help me ???

0 Karma

elmadi_fares
Loves-to-Learn Everything

I need to have a condition to assign a snow incident to two different groups according to the time slot in working and non-working hours

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please edit your post to put the question in the body rather than the subject.  As it is now, the question is truncated so we don't know what the problem is.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...