Splunk Search

In my index vital metrics, how can i find host status ( which can take up or down values)?

chimell1
Explorer

Hi Community

In my index vital metrics how can i find host status ( which can take up or down values)

Up when host is up

Down when host is down

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @chimell1,

in general you could run something like this:

index=your_index (up OR down)
| eval status=if(searchmatch("up"),"up","down")
| ...

could you share a sample of your data to test it?

then what do you want to obtain?

Ciao.

Giuseppe

0 Karma

chimell1
Explorer

This is my search

|mpreview index=*_vitals_windows_metric

And belong is a screen short of my result.

I want to knom the status of each host

 

thank you

0 Karma

chimell1
Explorer

Hi gcusello Thank you for your answer Please know that my index is:  *vitals_window_metric I can not see up or down values in my metric event of my index Thank

0 Karma
Get Updates on the Splunk Community!

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...