Splunk Search
Highlighted

How to get disabled server status on the basis of time compare query.

New Member

Hi,

I have a log with number of entries for many servers like-
Time1 user1 server1 statusdown
Time2 user2 server2 statusdown
Time3 user3 server1 statusup

So I need to capture only those servers which are down.but here in the log for same server many status are present I am not able to get the latest down status for a particular server. As the server logs have both status n we need to get the latest status.

Please help.

0 Karma
Highlighted

Re: How to get disabled server status on the basis of time compare query.

Legend

Assuming you have the status extracted to a field called status, try this

... | chart latest(_time) as time over server by status | where statusdown>statusup
0 Karma
Highlighted

Re: How to get disabled server status on the basis of time compare query.

SplunkTrust
SplunkTrust

Get just a list this way:

... | stats latest(status) by server | search status=statusdown

This will give the most recent status for each server, then only give the ones where the most recent status is down.