How to edit my search to display "VPN UP" or "VPN DOWN" based on the result of a field value?

[jd]

Hy,

I'm searching to monitor my VPN. I found a way to search the latest values of my field "vpntype" in the last 2 minutes. If my vpntype =ipsec-static, then my vpn is UP. If it is blank, my VPN is down :

host="172.10.0.28" vpntype="ipsec-static" | stats latest(vpntype)

Can i have a way to display "VPN UP" instead of the vnptype values ?

Thanks.

[Patient · Accepted solution]

Hi,
try with:

host="172.10.0.28" vpntype="ipsec-static" | stats latest(vpntype) as val|eval  latest_vpntype=if(vpntype=="ipsec-static", "VPN UP", val)| table latest_vpntype

[jd]

Great !! Thanks.

[Patient]

Thank for your vote.

[satishsdange]

Hi -
Please try below -
your base search | eval VPN_Status=case(vpntype==ipsec-static, "VPN UP", vpntype!=ipsec-static, "VPN DOWN")

[jd]

Hy,

Thanks. I try it but don't works. my visualisation is "ipsec-static".