topic Dashboard outputting pattern in Dashboards & Visualizations

Dashboard outputting pattern

sarahw3 — Tue, 29 Sep 2020 15:13:44 GMT

I have events that are statuses of cameras. I want to create a panel that outputs the names of the cameras whose status="Never_Checked" or "No_Images for three days in a row. For example, if camera 1A was never checked on 8/1, 8/2, and 8/3, 1A will be added to a list. Is this possible?

Re: Dashboard outputting pattern

sbbadri — Tue, 29 Sep 2020 15:13:47 GMT

try this

index=xx sourcetype=xxx earliest=-3d@d latest=now status="Never_Checked" OR status="No_Images" | table camera status

I hope status field got extracted from events.

Re: Dashboard outputting pattern

sarahw3 — Thu, 03 Aug 2017 18:36:03 GMT

It is not showing any events. This could be because I have only put in up to April 2017 this year into splunk. Is there a way I can make it looks at the 3 days before the date that is selected?

Re: Dashboard outputting pattern

sbbadri — Thu, 03 Aug 2017 20:16:04 GMT

can you post one sample event

Re: Dashboard outputting pattern

woodcock — Tue, 05 Sep 2017 01:06:19 GMT

Let's make it flexible. If you select Last 3 days then this will check for 3 days as you desire but if you change the timepicker, it will shift.

|gentimes start=-4
| rename starttime AS _time
| fields _time
| streamstats count AS _serial
| eval host="camera1 camera2 camera3 camera4 camera5"
| makemv host
| mvexpand host
| eval status=case(host="camera5", "OK",
                   host="camera1", "Never_Checked",
                   host="camera2", "No_Images",
                   _serial=1, "Never_Checked",
                   _serial=2, "No_Images",
                   _serial=3 AND host="camera3", "No_Images",
                   _serial=3 AND host="camera4", "OK",
                   true(), "No_Images")

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| stats values(status) AS status dc(status) AS statusCount BY host
| where (statusCount=1 AND (status="Never_Checked" OR status="No_Images")) OR (statusCount=2 AND status="Never_Checked" AND status="No_Images")