Hi,
I would like to run a search,which gives me the list of host with status' - normal,warning and critical
Where Critical being logs not present in a host for 30 mins,warning - not present in 15 mins and but lesser than 30 mins and otherwise its normal.
Am facing 2 problems here,if a server has no logs for 2 days,and when i run a search today,my search is not showing up that host itself.
Another problem is that when change my time modifier to issue time,it is not showing the exact result.
Below is the query used.
index = abc* host=efg*
|stats latest(_time) as latest by host
|eval Status = case (latest <= relative_time(now(),"-15m") AND latest > relative_time(now(),"-30m"),"Warning",
latest <= relative_time(now(),"-30m"),"Critical",
true(),"Normal")
|eval Recent_Updated_Time = strftime(latest,"%c")
Kindly suggest
... View more