host=schroeder index=os sourcetype=ps COMMAND=udpub |dedup PID|stats count AS udpub_cnt by host
|appendcols [ search host=schroeder earliest=-2m index=os sourcetype=ps COMMAND=aimglog |dedup PID|stats count AS aimglog_cnt by host]
|appendcols [ search host=schroeder earliest=-2m index=os sourcetype=ps COMMAND=bimglog|dedup PID|stats count AS bimglog_cnt by host]
|appendcols [ search host=schroeder earliest=-2m index=os sourcetype=ps COMMAND=smm |dedup PID|stats count AS smm_cnt by host]
|appendcols [ search host=schroeder earliest=-2m index=os sourcetype=ps COMMAND=sm |dedup PID|stats count AS sm_cnt by host]
|appendcols [ search host=schroeder earliest=-2m index=os sourcetype=ps COMMAND=sbcs |dedup PID|stats count AS sbcs_cnt by host]
|appendcols [ search host=schroeder earliest=-2m index=os sourcetype=ps COMMAND=syncd "_"|dedup PID|stats count AS syncd_cnt by host]
|appendcols [ search host=schroeder earliest=-2m index=os sourcetype=ps COMMAND=cleanupd |dedup PID|stats count AS cleanupd_cnt by host]
| eval udpub_status=case(udpub_cnt==8,"OK",udpub_cnt!=8,"NOT OK")
| eval smm_status=case(smm_cnt==1,"OK",smm_cnt!=1,"NOT OK")
|eval sm_status=case(sm_cnt==1,"OK",sm_cnt!=1,"NOT OK")
| eval sbcs_status=case(sbcs_cnt==1,"OK",sbcs_cnt!=1,"NOT OK")
|eval syncd_status=case(syncd_cnt==2,"OK",syncd_cnt!=2,"NOT OK")
| eval cleanupd_status=case(cleanupd_cnt==1,"OK",cleanupd_cnt!=1,"NOT OK")
| eval aimglog_status=case(aimglog_cnt==4,"OK",aimglog_cnt!=4,"NOT OK")
| eval bimglog_status=case(bimglog_cnt==4,"OK",bimglog_cnt!=4,"NOT OK")
|fields host *status *cnt |collect index=cactus_summary
... View more