@cdevoe57 Try below, index="server" source="Unix:Service" UNIT IN ("iptables.service", "auditd.service", "chronyd.service")
| eval status=if(ACTIVE=="failed" OR ACTIVE=="inactive", "failed", "OK")...
See more...
@cdevoe57 Try below, index="server" source="Unix:Service" UNIT IN ("iptables.service", "auditd.service", "chronyd.service")
| eval status=if(ACTIVE=="failed" OR ACTIVE=="inactive", "failed", "OK")
| eval service=case(
UNIT=="iptables.service", "IPTABLES",
UNIT=="auditd.service", "AUDITD",
UNIT=="chronyd.service", "CHRONYD"
)
| stats values(status) as status by host service
| xyseries host service status
| where IPTABLES="failed" OR AUDITD="failed" OR CHRONYD="failed"
| table host IPTABLES AUDITD CHRONYD Regards, Prewin Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!