host="10.145.254.*" UPDOWN | rex "(?i) Interface (?P [^,]+)" | stats count by port,host above was the fix ... View more

I changed the alert to: sourcetype=syslog UPDOWN | rex "(?i) Interface (?P [^,]+)" | stats count by port | sort - count | where count>=8" so it would catch on my interface report looking like: Dec 19 14:10:16.897: %LINK-3-UPDOWN: Interface FastEthernet0/41, changed state to down However now if i have multiple switches on which the same interface is bouncing it would all catch it under 1 hit. Would it be possible to include the ip\hostname somehow in the output. ... View more