This search will actually help to detect when there is no log from resource types.(interface down or any problem in logging etc.) If this is not exactly what you want, can you specify your request in more detail? ... View more

Hi @sekhar463   Can u try this.   | tstats latest(_time) as latest_time where index=yourindex sourcetpye=juniper* by sourcetype | append [| search index=yourindex sourcetype=juniper* | eval latest_time=relative_time(now(),"-10m")] | stats max(*) as * by sourcetype | eval dif = now() - latest_time | search dif > 600     it will work if there is no log from any sourcetype in the last 10 minutes. You can set the time according to you. ... View more

Hi @supraja  can you try the search below. index=.... table .... |outputlookup append=true yourfile.csv ... View more

Hi @villnooB  you can add the following search to the end of your own search. | autoregress ip | eval ip=coalesce(ip,ip_p1) | fields - *p1   ... View more

Hi @Dharani  If I understood correctly, if you don't want to see "withdrawal failed" error coming with "insufficient balance", you can try with the search I mentioned. I hope it works.    index=yourindex sourcetype=yorsourcetype ... | stats count values(message) as message by requestId | where count < 2   ... View more