Hello everybody (皆おはようございます)
I have a new request for all members 🙂
This search :
sourcetype=sccm |streamstats count current=t reset_on_change=true by date_wday,date_month,date_hour,date_minute,date_second, Service_Status | table count, Service_Status,Service_Name
Result :
count Service_Status Service_Name
1 Found service XDSnscls
2 Found service XDSsnaptunnel
3 Found service XDSclm
4 Found service XDSsdsd
5 Found service XDSsccm
6 Found service XDSsccmms
7 Found service XDSdss
8 Found service XDSauth
This is the same pattern every time and I wish to create an alert.
For example :
Verify the list of Service_Name and if one of them isn't in the list, I have an alert.
Thanks for your help.
Best regards
Laurent
My solution would be:
1. Create a lookup file with the services that you expect. Two columns; service_name and status. Status is a dummy field.
2. Create a search which starts with | inputlookup and join that with your search so if your search doesn't return a result you miss a field from that search. Finish the search with | search NOT certainField = *
3. Create an alert based on that search which results in all events from the lookup for which no data was found in the index.
My solution would be:
1. Create a lookup file with the services that you expect. Two columns; service_name and status. Status is a dummy field.
2. Create a search which starts with | inputlookup and join that with your search so if your search doesn't return a result you miss a field from that search. Finish the search with | search NOT certainField = *
3. Create an alert based on that search which results in all events from the lookup for which no data was found in the index.
cmeerbeek,
Thanks for your solution.
That works good. I hope our partners will not change the number of services or there name.
Best regards,
laurent