Hi @sanketas,
you could search for the printer_queue that didn't received bytes in the last period.
Only one question: if a printer is inactive or in error, does it send logs?
If yes, you can run something like this:
host=USSLCP1OPTIO0* SourceName=*Print*
| rex "printed on (?<Printer_queue>\w+)"
| rex "port (?<Port>\w+)"
| rex "Size in bytes: (?<Size>\w+)"
| search Printer_queue = *
| stats sum(Size) AS Size by Printer_queue
| where Size=0
if instead the inactive printers don't send logs, you have to create a lookup (called e.g. "printers.csv", containing one column called "Printer_queue") containing the printers to monitor and check the list with this lookup, something like this:
host=USSLCP1OPTIO0* SourceName=*Print*
| rex "printed on (?<Printer_queue>\w+)"
| rex "port (?<Port>\w+)"
| rex "Size in bytes: (?<Size>\w+)"
| search Printer_queue = *
| stats sum(Size) AS Size by Printer_queue
| append [ | inputlookup printers.csv | eval Size=0 | fields Printer_queue Size ]
| stats sum(Size) AS total BY Printer_queue
| where total=0
The printers.csv lookup must be maintained using a scheduled search or manually, I prefer the second option to have a better control on the monitoring.
One additional hint: use always the index in your searches, they are faster!
Ciao.
Giuseppe
