eed to show in a dashboard if one or more servers is up or down.
How can I do this?
I tried to create a search that counts the processes of each server:
* if the count is >0 the server is up,
* when the count is = 0 the server is down.
I would show a green pie when the server is up and a red pie when is down.
The problem is that when the server is down I haven't any log so the result is null and I don't know how to show zero
Thank you in advantage.
Bye.
Giuseppe
I used this solution:
| inputlookup server_list.csv | eval count=0 | append [ search index=xxx | stats count by host ] | stats sum(count) AS Total | where Total=0 | table host
In this way I have all the servers of my lookup that don't are present in my logs.
Bye.
Giuseppe
I used this solution:
| inputlookup server_list.csv | eval count=0 | append [ search index=xxx | stats count by host ] | stats sum(count) AS Total | where Total=0 | table host
In this way I have all the servers of my lookup that don't are present in my logs.
Bye.
Giuseppe
I use a set union
of my search with a inputlookup
of a CSV list of expected servers. This enables a server to appear in the results even if no events are found for it.