topic Re: How do I create a dashboard visualization that is single pane, 4 statuses? : (Stopping, Stopped, Starting, Started) in Dashboards & Visualizations

How do I create a dashboard visualization that is single pane, 4 statuses? : (Stopping, Stopped, Starting, Started)

gaurav_ramteke — Mon, 10 Sep 2018 15:20:16 GMT

Hi Guys,

Working on one PoC and week in search commands
After extracting fields i get four search strings as given below for an individual service status

index=* sourcetype=* service_status="*Core Stopping"
index=* sourcetype=* service_status="*Core Stopped"
index=* sourcetype=* service_status="*Core Starting"
index=* sourcetype=* service_status="*Core Started"

I want to create a dashboard (visualization of the service status) (Single pane 4 status): (Stopping, Stopped, Starting, Started)

please help

Thanks and Appreciated

Re: How do I create a dashboard visualization that is single pane, 4 statuses? : (Stopping, Stopped, Starting, Started)

efavreau — Mon, 10 Sep 2018 20:44:23 GMT

I'm not clear on exactly what you're looking for, but maybe it's one of these two possabilities:
You are looking for the number of times you want to know each service status has occurred. If so, then look at the following run anywhere example that will pull the number of events for some sourcetypes in Splunk's _internal index.

index=_internal sourcetype="*d_access" OR sourcetype="*d_ui_access" OR sourcetype="*k_web_access" earliest="-1m@m" latest="@m"
| stats count BY sourcetype

After running this, go to the Visualization tab, select "Single Value", then click "Trellis" and you would get the count for each sourcetype in one visualization for a single panel in your dashboard.

If you meant you wanted the single value to indicate the current status based on whenever the search was ran, and one of the 4 types of service_status would be shown. Then we can use a case statement to rename the event as we need to match it, and get the last event. This is the most recent status.

index=_internal sourcetype="*d_access" OR sourcetype="*d_ui_access" OR sourcetype="*k_web_access" earliest="-1m@m" latest="@m" 
| eval sourcetype=case(
    sourcetype LIKE "%ui%","UI was the last event",
    sourcetype LIKE "%web%","WEB was the last event",
    sourcetype LIKE "%","splunkd_access was the last event"
    ) 
| stats last(sourcetype)

Then you go to the visualization tab, select "Single Value". You could then use this as a panel, where the status would change based on the timeframe the search was ran.

Re: How do I create a dashboard visualization that is single pane, 4 statuses? : (Stopping, Stopped, Starting, Started)

gaurav_ramteke — Tue, 11 Sep 2018 11:50:12 GMT

Thank you efavreau

This helped me and its working now its just me to play around the colors
Much Appreciate 🙂