How to generate a search that will compare list of servers and give the difference in server status?

[atulitm]

Whenever server on F5 gets down it shows log like :

Virtual /Common/vs has become unavailable

When server on f5 comes back up :

Virtual /Common/vs has become available

Splunk search to list servers which went down :

(index=* "has become unavailable" | rex "(?Virtual \s*([^\s]*))" | dedup unavailable | table unavailable

Splunk search to list servers which came up :

(index=*  "has become available" | rex "(?Virtual \s*([^\s]*))" | dedup available | table available

Following Splunk searches give me list of virtual server which went down and came up . Now i would like compare list of servers which went down with the servers which came up and give me difference (i.e server names which went down but never came up).
Tried join/append but it doesn't work. Can someone please help!!

[richgalloway · Accepted solution]

Try this. It takes the most recent status for each server and keeps only those that are still unavailable.

index=foo "has become unavailable" OR "has become available" | rex "Virtual (?<server>[^\s]+) has become (?<status>\w+" | dedup server | where status = "unavailable" | table server status

[atulitm]

Excellent ,it works . I didn't knew that i can use dedup to find latest log as well apart from removing duplicates 😞 .. Thanks for help !!