Splunk Search

In my index vital metrics, how can i find host status ( which can take up or down values)?

chimell1
Explorer

Hi Community

In my index vital metrics how can i find host status ( which can take up or down values)

Up when host is up

Down when host is down

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @chimell1,

in general you could run something like this:

index=your_index (up OR down)
| eval status=if(searchmatch("up"),"up","down")
| ...

could you share a sample of your data to test it?

then what do you want to obtain?

Ciao.

Giuseppe

0 Karma

chimell1
Explorer

This is my search

|mpreview index=*_vitals_windows_metric

And belong is a screen short of my result.

I want to knom the status of each host

 

thank you

0 Karma

chimell1
Explorer

Hi gcusello Thank you for your answer Please know that my index is:  *vitals_window_metric I can not see up or down values in my metric event of my index Thank

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...