I am looking to make a "pulse" dashboard for a host on my network, it will pulse green up when up and red when down. so far I have: index=index sourcetype=sourcetype log_type=type hostname=host | eval logs=case(count>0, "1", count=0, "2")  | eval Status=case(Logs=1, "Green", Logs=2, "Red") I believe there is an error in the case line with the count. I have to be missing something.  any insight would be helpful! ... View more

Hello, I am currently building correlation searches in ES and I am running into a "searches delayed" issue. some of my searches run every hour, most are every 2 hours, and some every 3, 12 hours. My time range looks like: Earliest Time: -2h  Latest Time: now cron schedule: 1 */2 * * * for each new search I add +1 to the minute tab of the cron schedule up to 59 and then start over.  so on the next search the schedule would be 2 */2 * * * and so on... is there a more efficient way I should be scheduling searches? Thank you. ... View more

I am trying to make a search that will fire only when an admin makes a change to their own account. I want to know if a-johndoe gives multiple permissions to a-johndoe and NOT if a-johndoe gives permissions to a-janedoe.  would i use an IF statement for this?   Thank you ... View more