With log data as such: date_time server=server1 group=group1 status=statusA date_time server=server2 group=group1 status=statusA date_time server=server3 group=group1 status=statusA date_time server=server4 group=group1 status=statusA date_time server=server1 group=group2 status=statusA date_time server=server2 group=group2 status=statusA date_time server=server3 group=group2 status=statusA date_time server=server7 group=group2 status=statusA date_time server=server1 group=group1 status=statusB date_time server=server2 group=group1 status=statusB date_time server=server3 group=group1 status=statusB date_time server=server1 group=group2 status=statusB date_time server=server2 group=group2 status=statusB I’d like to be able to show a table of results that look like this: group1 server1 statusB .............server2 statusB .............server3 statusB .............server4 statusA group2 server1 statusB .............server2 statusB .............server3 statusA .............server7 statusA The table should show all groups that appear in the log, and under each group it should list all servers that are associated with that group along with the most recent status for each of those servers in that particular group. ... View more

I need to create an alert based on a number of events occurring in a particular time period for multiple servers. I know how to do a search to do this for a single server, but I can't figure out if there's a way to do more than one in a single search. I don't want to have to set up individual alerts for each server (too many servers, and needs to pick new ones up automatically), and I can't have the counts need to be independent by server. So for example: I have 100 servers that would match host=*abcd* , and I need to know if any of them have more than 3 events that match field=XXXX in a 5 minute period. It can't alert of I have three different servers that have the matching event, only if a each individual server has that count of the event. Hopefully this makes sense. ... View more