I'm trying to show a simple Yes (green) / No (red) on a dashboard based on a host not reporting for longer than 5 minutes. Seems to be a bit harder than I expected. What I've got:
index=index host=host
| stats latest(_time) as last_seen | eval duration_since = tostring(now() - last_seen, "duration") | eval stringtime=if(duration > "00:05:00", "Yes", "No") | table stringtime
But this shows "No" at all times, even though the host reported 1 second ago. What am I doing wrong?
↧