We have a system where, when a service name (a unique service name referenced by service=service_N where N=1 to 20) dies, it gets assigned to another host. To explain further...
We have service=service1 running on host=hostname1 initially. After sometime, because of some reason, service1 dies on hostname1, but a new service comes up on another host with the same name. So after a time T, service=service1 is running on host=hostname2. I am able to get the changing state of the service name from the event logs in Splunk using the search:
service=service1 | stats value(host) by service
and I get this:
service1 | hostname1
| hostname2
1. How do I capture the time when the service name assignment changed?
2. What is the best way to graph this data when service=service* ?
Thanks
↧