Create dashboard to show vmware AlarmStatusChangedEvent until event goes from red to green

wilcoxj — Wed, 05 Feb 2020 21:21:17 GMT

I am running index=vmware-taskevent | spath eventClass | search eventClass=AlarmStatusChangedEvent and I want to have my dashboard show only the events that have not changed from red to green.

Here is the raw text:
{"entity": {"entity": {"moid": "host-145895", "type": "HostSystem"}, "name": "cpcdwesx02.na.cintas.com"}, "datacenter": {"datacenter": {"moid": "datacenter-21", "type": "Datacenter"}, "name": "Mason"}, "createdTime": "2020-02-05 21:17:48.765000+00:00", "alarm": {"alarm": {"moid": "alarm-1", "type": "Alarm"}, "name": "Host connection and power state"}, "source": {"entity": {"moid": "group-d1", "type": "Folder"}, "name": "Datacenters"}, "eventClass": "AlarmStatusChangedEvent", "chainId": "-1182388515", "host": {"host": {"moid": "host-145895", "type": "HostSystem"}, "name": "cpcdwesx02.na.cintas.com"}, "to": "green", "computeResource": {"computeResource": {"moid": "domain-s145893", "type": "ComputeResource"}, "name": "cpcdwesx02.na.cintas.com"}, "from": "red", "fullFormattedMessage": "Alarm 'Host connection and power state' on cpcdwesx02.na.cintas.com changed from Red to Green", "userName": "None", "key": "-1182388515"}

Re: Create dashboard to show vmware AlarmStatusChangedEvent until event goes from red to green

to4kawa — Sat, 08 Feb 2020 01:41:09 GMT

Sample:

|makeresults
| eval _raw="{\"entity\": {\"entity\": {\"moid\": \"host-145895\", \"type\": \"HostSystem\"}, \"name\": \"cpcdwesx02.na.cintas.com\"}, \"datacenter\": {\"datacenter\": {\"moid\": \"datacenter-21\", \"type\": \"Datacenter\"}, \"name\": \"Mason\"}, \"createdTime\": \"2020-02-05 21:17:48.765000+00:00\", \"alarm\": {\"alarm\": {\"moid\": \"alarm-1\", \"type\": \"Alarm\"}, \"name\": \"Host connection and power state\"}, \"source\": {\"entity\": {\"moid\": \"group-d1\", \"type\": \"Folder\"}, \"name\": \"Datacenters\"}, \"eventClass\": \"AlarmStatusChangedEvent\", \"chainId\": \"-1182388515\", \"host\": {\"host\": {\"moid\": \"host-145895\", \"type\": \"HostSystem\"}, \"name\": \"cpcdwesx02.na.cintas.com\"}, \"to\": \"green\", \"computeResource\": {\"computeResource\": {\"moid\": \"domain-s145893\", \"type\": \"ComputeResource\"}, \"name\": \"cpcdwesx02.na.cintas.com\"}, \"from\": \"red\", \"fullFormattedMessage\": \"Alarm 'Host connection and power state' on cpcdwesx02.na.cintas.com changed from Red to Green\", \"userName\": \"None\", \"key\": \"-1182388515\"}"
| spath createdTime
| spath eventClass
| spath from
| spath to
| table createdTime eventClass from to

query:

index=vmware-taskevent "AlarmStatusChangedEvent" NOT "changed from Red to Green"

dashboard:
As you like.

topic Re: Create dashboard to show vmware AlarmStatusChangedEvent until event goes from red to green in Getting Data In

Create dashboard to show vmware AlarmStatusChangedEvent until event goes from red to green

Re: Create dashboard to show vmware AlarmStatusChangedEvent until event goes from red to green