I am currently attempting to create a 'summary' type of view within a dashboard stating that this list of services (svc1,svc2,svc3,svc4) are all running on the machine, but is only displaying and either "OK" or "DOWN" Status. If ANY of these services are down, this query should show the "DOWN" status, as this is just a summary panel.
The search I am working with currently is as follows:
That being said, it gives me the display i'm looking for (1 status of either OK or DOWN per machine) though if 1 of the 5 services are down, the summary 'State' field doesn't change to "DOWN".
I suppose I'm attempting to summarize the running state of 5 services into one instance of either "OK" if all 5 services are running, but even if only 1 of them is not, then the summary field would switch to a "DOWN" state.
Let me know if I don't make sense right now.. i've been looking at these things all day, so I apologize for any minced words. Any help is greatly appreciated!
You could order by State Ascending before deduping, then if there are any "down" it will show up top.. That seems like a much easier solution
That will require you to move your "if" statement though before the sort,dedup
| sort State | dedup etc.
based on this use case ...
the running state of 5 services into one instance of either "OK" if all 5 services are running, but even if only 1 of them is not, then the summary field would switch to a "DOWN" state. ... you can use a search like this:
sourcetype=WMI:Service (Name=<svc_1> OR Name=<svc_2> OR Name=<svc_3> OR Name=<svc_4> OR Name=<svc_5>) | dedup host | eventstats count(eval(State="Running")) AS myCount | eval State=if(myCount=="5", "OK", "Down") | table _time,host,Name,State | rename Name as "Service Name"
this will count all the running states and if the count is
State field is
OK, if the count is not 5 the
State field is
hope this helps ...