Whenever server on F5 gets down it shows log like :
Virtual /Common/vs has become unavailable
When server on f5 comes back up :
Virtual /Common/vs has become available
Splunk search to list servers which went down :
(index=* "has become unavailable" | rex "(?Virtual \s*([^\s]*))" | dedup unavailable | table unavailable
Splunk search to list servers which came up :
(index=* "has become available" | rex "(?Virtual \s*([^\s]*))" | dedup available | table available
Following Splunk searches give me list of virtual server which went down and came up . Now i would like compare list of servers which went down with the servers which came up and give me difference (i.e server names which went down but never came up).
Tried join
/append
but it doesn't work. Can someone please help!!
Try this. It takes the most recent status for each server and keeps only those that are still unavailable.
index=foo "has become unavailable" OR "has become available" | rex "Virtual (?<server>[^\s]+) has become (?<status>\w+" | dedup server | where status = "unavailable" | table server status
Try this. It takes the most recent status for each server and keeps only those that are still unavailable.
index=foo "has become unavailable" OR "has become available" | rex "Virtual (?<server>[^\s]+) has become (?<status>\w+" | dedup server | where status = "unavailable" | table server status
Excellent ,it works . I didn't knew that i can use dedup to find latest log as well apart from removing duplicates 😞 .. Thanks for help !!