Splunk Search

search down sevices

Path Finder

Hi ,

I have a list of services in my oracle server ,
i want to control the status of this services (Services Up and Services Down)
I create an alerte to give me the liste of the active services ( sourcetype=srvscript | stats count values(CMD) by _time |rename values(CMD) as "CMD" | where count < 7) and this worked fine ,
I want now to create an alerte to give me the services down , so i create a csv file contains the list of all existing services, and i want to compred with the search already created that gives the active services now,
I need a search that gives me the name of service not active (missing in search result of active services) ==> so how to compare the csv file contents and the active service result to find the non-active services ?

0 Karma


Hi aalaa,
if the field containing services is called "service", see something like this:

index=oracle sourcetype=srvscript 
| eval service=lower(service)
| stats count BY service
| append [ | inputlookup existingServices | eval count=0, service=lower(service) | fields count service ]
| stats sum(count) AS Total By service
| eval Status=if(Total=0,"Down","Up")
| sort service
| table service Status

You can also display this table in a graphic mode.

A little hint: use always the index=<your_index> option to have more performat searches.


0 Karma


A subsearch should do it.

sourcetype=srcscript NOT [|inputlookup existingServices | format ]
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...