I have a lookup table with fields Application name and host, and i have a realtime Incident data with index, sourcetype and ServerName. I have two things to be retrieved.
1. If there is a incident created with ServerName matching the host in the lookup table and the Summary field as Server down then display the result as Down
2. if there is no incident ticket created for the host then the result should always show as UP ( meaning by default the result should be UP for last 60 mins unless we have a ticket with above criteria)
below is the query which i tried but it is showing the result only when there are any relevant data in the index
| inputlookup ServerFile
| rename "host" as "ServerName"
| join type=inner ServerName
[ search index=Data sourcetype="incidents"
| eval Result=if(SHORT_DESCRIPTION like "host Down%", "DOWN","UP")
| table ServerName Result]
... View more