Splunk Search for F5 Up/Down Pool member status

This search is basically for the nodes that had a “down” message without a corresponding “up” in the last week. All we would need to do is filter by service area’s/ ip ranges and setup a daily alert…

http://splunk.somedomain.com/en-US/app/search/flashtimeline?q=search%201.3.6.1.4.1.3375%20%22monitor%20status%22%20|%20transaction%20bigipNotifyObjNode%20startswith%3D%22monitor%20status%20down%22%20endswith%3D%22monitor%20status%20up%22%20keepevicted%3Dt%20|%20search%20closed_txn%3D0%20|%20timechart%20count%20by%20bigipNotifyObjNode&earliest=-7d%40h&latest=now&c.chart=line&c.title=&c.stack=none&c.split=false&c.nulls=gaps&c.legend=right&c.x.title=&c.y.title=&c.y.min=&c.y.max=&c.y.scale