topic Re: Visualization solution in Knowledge Management

Visualization solution

waJesu — Wed, 14 Oct 2020 10:17:00 GMT

I am new to splunk administration. may someone help with a query that gives both reporting and non-reporting devices in the last 1 hour and be able to show both on a pie-chart

Re: Visualization solution

rnowitzki — Wed, 14 Oct 2020 11:24:33 GMT

Hi @waJesu ,

You would need some base to start from. Splunk doesn't really know what's not there.
There are different approaches for this. I'll give you two:

1. Compare the devices that reported in the last 24h with the ones that reported in the last 1h
2. Maintain a Lookup table with all the devices that should report and compare this with the ones that reported in the last 1h.

To help you with the SPL, it would be helpful to see some example data. What kind of devices are in the logs, how do you determine that they are reporting? Do you look for any kind of log from each host(?) or do you expect some specific logline?

BR
Ralph

Re: Visualization solution

waJesu — Wed, 14 Oct 2020 11:36:34 GMT

Thanks Ralph. Would you help with the search query for the reporting devices

Re: Visualization solution

rnowitzki — Wed, 14 Oct 2020 12:13:57 GMT

Hi @waJesu ,

well, it really depends on your data.

But to give you an example.

This will give you the pure count of "missing" and "up" devices based on a 24h vs 1h compare. In the visualization tab you would select pie chart and your done.

You have to set the index to match your data and also you probably have to change "device" to whatever field your "device" name is stored in. Maybe "host"?

If you remove the last line, you see which devices are missing/up.

Hope it gives you an idea.
BR
Ralph

Re: Visualization solution

waJesu — Wed, 14 Oct 2020 14:38:56 GMT

Hey Brian. I am not sure why it's returning Error in "eval" command: The expression is malformed. Expected

Re: Visualization solution

rnowitzki — Wed, 14 Oct 2020 14:44:05 GMT

Not Brian here, but anyways 🙂

Can you copy&paste your SPL and the whole error message? The only 2 evals in my example are pretty straight forward, not sure what could have gone wrong.

BR
Ralph aka Brian