I need to find the missing list of process from a list of hosts and setup an alert
There will be number of process ~ 16 process to be monitored on number of hosts.
I need some help in evaluating which process is missing
I can take lookup file approach but would like to do a search and eval with out using a lookup.
I tried this way
earliest=-10m@m (index=os* OR index=matrix_os) source=ps host=abc* |rex field=COMMAND "somename\/(?[^\/]*)/httpd/sbin/httpd" |stats count by inst host |eval mylist="inst0,inst1,test1,test2" |eval procname=split(mylist,",")|mvexpand procname|eval is_running=if(match(procname, inst),1,0)|table is_running host inst count procname
This lists out all matching and non matching . I want to just list out where procname=test1 on host which is not found.
... View more