I am running index=vmware-taskevent | spath eventClass | search eventClass=AlarmStatusChangedEvent and I want to have my dashboard show only the events that have not changed from red to green.
Her...
See more...
I am running index=vmware-taskevent | spath eventClass | search eventClass=AlarmStatusChangedEvent and I want to have my dashboard show only the events that have not changed from red to green.
Here is the raw text:
{"entity": {"entity": {"moid": "host-145895", "type": "HostSystem"}, "name": "cpcdwesx02.na.cintas.com"}, "datacenter": {"datacenter": {"moid": "datacenter-21", "type": "Datacenter"}, "name": "Mason"}, "createdTime": "2020-02-05 21:17:48.765000+00:00", "alarm": {"alarm": {"moid": "alarm-1", "type": "Alarm"}, "name": "Host connection and power state"}, "source": {"entity": {"moid": "group-d1", "type": "Folder"}, "name": "Datacenters"}, "eventClass": "AlarmStatusChangedEvent", "chainId": "-1182388515", "host": {"host": {"moid": "host-145895", "type": "HostSystem"}, "name": "cpcdwesx02.na.cintas.com"}, "to": "green", "computeResource": {"computeResource": {"moid": "domain-s145893", "type": "ComputeResource"}, "name": "cpcdwesx02.na.cintas.com"}, "from": "red", "fullFormattedMessage": "Alarm 'Host connection and power state' on cpcdwesx02.na.cintas.com changed from Red to Green", "userName": "None", "key": "-1182388515"}