Very nice! Created a multiple process monitor like index=os sourcetype=ps host=dcagsm* | eval gsa_is_running=if(match(_raw, "GSA"), "GSA Running", "GSA Not Running") | eval GSC_is_running=if(match(_raw, "GSC"), "GSC Running", "GSC Not Running") | eval GSM_is_running=if(match(_raw, "GSM"), "GSM Running", "GSM Not Running") | eval LH_is_running=if(match(_raw, "LH"), "LH Running", "LH Not Running") | stats first(gsa_is_running) as GSA, first(GSC_is_running) as GSC, first(GSM_is_running) as GSM, first(LH_is_running) as LH, by host | search "Not Running" ... View more