counting the latest servers

[fresned]

Hi,

My log contains entries as shown below:

5:12:08.100 PM | activateServerlocked | tid:2552 | serverID="dev1" State="UP"

5:01:58.055 PM | deactivateNode | tid:2552 | serverID="dev1" State="DOWN"

3:51:53.115 PM | activateServerlocked | tid:2552 | serverID="dev1" State="UP"

3:46:48.092 PM | activateServerlocked | tid:2552 | serverID="dev2" State="UP"

4:56:41.099 AM | deactivateNode | tid:2552 | serverID="dev2" State="DOWN"

4:51:36.056 AM | activateServerlocked | tid:2552 | serverID="dev2" State="UP"

I want to know how many servers are up at the time the query is ran. the issue is that the servers go up and down all the time. For example: now many servers are UP now.
The result should show 2

How can I get these numbers?

Appreciate any help!!

[sideview]

If you run the search back in time enough to where you're reasonably confident that each server appears at least once, you just run this:

<your searchterms> | stats first(State) as State by serverID | where State="UP"

[tfletcher_splun]

So to get this what we'll do is use the first result back in time from the time the search is run. This means that we will get the latest status of each unique server:

source="mylog" | dedup serverID  | stats count as "Number of Servers in State" list(ServerID) as "Server List" by State

[sdaniels]

This should give you the latest event for each serverID and then filter it by UP only and then count it.

sourcetype="yoursourcetype" | stats first(State) as State by serverID | search State=UP | stats count

[fresned]

Thanks this pointed me down the correct path.
this is what worked
sourcetype="mysourcetype"
| stats first(State) as State by serverID
| stats count(eval(State="UP")) AS Count_UP