One of my splunkforwarder is down last month .I am trying to find when the host is stop working .have to trigger alert when host is down.now i am using query that will check only 30 min .Can any one help on this.Thanks in advance My query : | metadata type=hosts index=XXX | eval age = now() - recentTime | eval status= case(age < 1800,"Running",age > 1800,"DOWN") | convert ctime(recentTime) AS LastActiveOn | eval age=tostring(age,"duration") | eval host = upper(host) | table host age LastActiveOn status | rename host as "Forwarder Name", age as "Last Heartbeat(min)",LastActiveOn as "Last Active On",status as Status| where Status= "DOWN" ... View more

How to extract success and fatal into one field and also extract two Fields after FATAL 2018-06-18 02:06:34,606|261529301994221|MA_SELECT|785M91236|602304234|001|WGS20||||EMAIL|SPALACIOS810@GMAIL.COM|LEVEL2|||SUCCESS|| 2018-06-18 02:06:34,294|7961529301994286|MA_SELECT|AN72688470000|202465241|001|NASCO||||EMAIL|SANGELI@OUTDRS.NET|LEVEL2||| FATAL|E000057P|Member not found ... View more

In below scenario i want to ignore two vales are null in the result. index=test |stats count by ErrorDetail ErrorMessage|fillnull value="Not Available" ErrorDetail |fillnull value="Not Available" ErrorMessage|where ErrorDetail!="Not Available" AND Errormessage!="Not Available" Result: PHARMACY Not Available Not Available 16 BenefitAccums INFRASTRUCTURE ERROR- WGMMMIOS BAD RETURN; RC = 1 Not Available 18 Excpected Result: BenefitAccums INFRASTRUCTURE ERROR- WGMMMIOS BAD RETURN; RC = 1 Not Available 18 Have to exclude both field have not available in the result. Thanks ... View more

index="testd" | rex field=_raw "Remote host:(?.*):" |dedup Remotehost |stats count by Remotehost My events: Remote host: 2.136.12.186 :34126]@684574 useCount=1 bytesRead=0 bytesWritten=2994631 age=163708ms lastIO=5ms ))).onExceptionWrite exception Expected output: 2.136.12.186 Thanks in advance ... View more