Hello,
I have a sourcetype which has data telling me if something goes offline and then when it comes online.
I am trying to write a search that only shows the most recent offline event where a newer online event has not yet occurred.
Any help is appreciated!
Like this:
... | streamstats count(eval(action="online")) AS sessionID BY host and other fields here
| stats count dc(action) AS action_count values(action) AS actions BY sessionID hsot and other fields here
| where action_count == 1
Hi dglass0215,
a sample of yur data could be useful, but anyway you should select the conditions, e.g. having:
you could run something like this, if it's relevant the duration of offline (e.g. online must come back at most in 5 minutes):
index=my_index (status="go offline" OR status="go online")
| transaction user host startswith="go offline" endswith="go online" keeporphans=true maxspan=300s
| search NOT status="go online"
| ...
But it's a slow search (transaction is a very slow command).
If instead it isn't relevant the time between offline and online, you could run something like this
index=my_index (status="go offline" OR status="go online")
| stats dc(status) AS count values(status) AS status BY user host
| where count=1
that's quicker.
Ciao.
Giuseppe
Thanks Giuseppe this is very helpful! I do realize a sample of my data would useful, it is just tough to do so since I am in a disconnected environment. Basically it is as simple as Host, TimeStamp, onlineStatus. I do not have a username field, nor do I (at least at this moment in time) care about the duration of offline. I just want to know if an offline has occurred without a corresponding online. Your second query above looks like it would almost do what I need! However couldn't that query wind up showing an online event depending on how the timeframe of the query was setup?
Thanks Again!
hi can you please provide some sample events and desired output?