Hello,
When I restart a large application with hundreds of processes, I can see a string like "startup successful" from the logs.
How can I display a list of host and sources which do not have this string?
host1:/a/b/c1/file1.log
host1:/a/b/c2/file2.log
host1:/a/b/c3/file3.log
host2:/a/b/c1/file1.log
host2:/a/b/c2/file2.log
host2:/a/b/c3/file3.log
...
Suppose host99:/a/b/c13/file23.log did not have the "startup successful" string. How would I display that?
Proving the negative is a bit harder than opposite. Assuming that all of those files are of the same sourcetype
, one approach is to use a simple subsearch;
sourcetype=XXX earliest=-15m NOT [search sourcetype=XXX earliest=-15m "startup successful" | dedup host, source | fields + host, source] | dedup host, source | table host, source
Set the earliest
time at the time of the restart, so you don't get irrelevant older events included. In this case I gave the application 15 minutes to startup, before running the search so-to-speak.
/K
The double negative type question is confusing me. 🙂 This search will give me a table of hosts,logs that do NOT have "start successful" message from the time I choose in the TimePicker.
Is not output to the list if any (host log is not output) host has not been activated within the specified time that it is the search is present but OK?
Since I'm selecting a custom time from the timepicker and my sourcetypes aren't exactly the same, I used:
host=host* sourcetype=logs* NOT [search host=host* sourcetype=logs* "startup successful" | dedup host, source | fields + host, source] | dedup host, source | table host, source
This works nicely. Thanks!