You can use "rule_description" as the field for the above description. ... View more

Update. I have found I can use this API to approve. But still need username password or token T^T. curl -X POST -k -u "username:password" https://10.250.74.118:8443//rest/approval/15/responses -d "{\"responses\": [\"deny\"]}" But it showing the error that： {"failed": true, "message": "Invalid resolution. must be one of approve, deny, delegate"} Anyone know why?   ... View more

I think the SPL and the concept of Davidpaper are good. But for some reason, in my environment, it will not be able to reveal all the hidden problems. My SPL is as follows, I hope people with the same problem can give it a try. It fix my problem.  index=_internal ClientSessionsManager | stats dc(hostname), values(hostname) by instanceId | sort - dc(hostname) ... View more