Splunk Search

How to get disabled server status on the basis of time compare query.

Anshumaan12
New Member

Hi,

I have a log with number of entries for many servers like-
Time1 user1 server1 statusdown
Time2 user2 server2 statusdown
Time3 user3 server1 statusup

So I need to capture only those servers which are down.but here in the log for same server many status are present I am not able to get the latest down status for a particular server. As the server logs have both status n we need to get the latest status.

Please help.

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Get just a list this way:

... | stats latest(status) by server | search status=statusdown

This will give the most recent status for each server, then only give the ones where the most recent status is down.

sundareshr
Legend

Assuming you have the status extracted to a field called status, try this

... | chart latest(_time) as time over server by status | where statusdown>statusup
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...