Hello, I am working on a query to check multiple service status from multiple servers and trying to display the current status of each service using windows event log 7036. Event ID 7036 captures the event for both services stopped and started. My requirement is on a given point of time service might restart multiple time and I don't want to list all restart state instead want to display the current status by comparing the data for each service against the current State. index IN (wineventappsys_*) EventCode=7036 host IN (ABC,DEF,GHI) | stats count by _time, host, EventCode, SourceName, LogName, Message | lookup service_list Message OUTPUT Short_Description Severity | eval State =if(match(Message,"running state"),"CLOSED","OPEN") | stats latest(_time) as Date by host State Short_Description | sort - host Date ShortDescription Here it still lists both open and closed events. I am trying to display data only with the last state for each service for each server. Any help is greatly appreciated. Naresh
... View more