Hello, Currently my search looks for the list of containers which includes initialised successfully message and lists them. The alert I have set is to look for the number of containers under total connections column and if it is less then 28, then some of them did not connect successfully How can pass I the list of containers in my search and compare that with the result produced and state if the result is missing a container please? Sorry I cannot provide the exact search on a public forum, so I am sharing something similar. Example: (my example just shows 4 containers) The search should return container A, container B, container C, container D Current search: index=* Initialised xxxxxxxxxxxx xxxxxx|rex "\{consumerName\=\'(MY REGEX)"|chart count AS Connections by name| addcoltotals labelfield="Total Connections" The current result is Container_Name | Count | Total_Connections Container A | 1 | Container B | 1 | Container C | 1 | Container D | 1 | 4 How can I tweak the above search to include container A,B,C and D and if container D is missing in the result, the search should compare the result with the values passed in the search and state which container is missing as the last line in the above table i.e. preserve the existing result but state which container is missing from the result as well please? Regards
... View more