Is it possible to consolidate all results from my search for all processes in my infrastructure and generate a summary?

[ryantzj]

Hi,
I have this request from my beloved client where he needs to have a dashboard that shows the availability of processes for the entire infrastructure in boolean such as "working", "not working".

sourcetype=process java  | stats dc(pid) as value | eval threshold =if(match(value,threshold),"working","not working")

I am using the query above daily to check if a right amount of processes is running and it will return "working" and "not working". My question is, can i consolidate all the results from the query above for each processes and generate a summary result to see if all running process met the threshold for a server? His ultimate goal is to have a single value box that only shows "working" or "not working" that represent the specific servers group.

We have tried our way with "writing data using splunk"
outputcsv but by doing this we need to schedule jobs to keep the csv updated which is practically difficult since we have a good number of servers and processes.

Thanks for the power booster ninja,
Ryan T

[mzorzi · Accepted solution]

You can use a

| stats count by tag::host_type

You can even take advantage of summary indexes, with a

| sistats count by tag::host_type

[ryantzj]

Hi thanks for your answer mzorzi, do you mind elaborate more ??