Anyone help me

Dhanaskv — Thu, 01 Apr 2021 07:33:59 GMT

My task

1. Prepare a new dashboard that shows the following:

2. Need to shows the new dashboard ----> InstanceID, InstanceType,CPUCreditBalance

3.I need to write a Splunk alert on a condition like

4. CPU credit balance < 30 then send alert email

Re: Anyone help me

gcusello — Thu, 01 Apr 2021 08:00:50 GMT

Hi @Dhanaskv,

your request is just a little vague...

Anyway, supposing that you already have the data in an index (otherwise you have to start from the beginning your approach to Splunk), you have to create the main search to use both for the dashboard and the alert.

Remember that everything in Splunk starts from a search!

so you have to find your search having something like this:

index=your_index | table InstanceID InstanceType CPUCreditBalance

(I suppose that you already extracted fields, otherwise you have to do this before.)

Taking the above search you can save it in a dashboard's panel, adding also some filter; in this way you have your dashboard, that you could also enrich adding some statistics (e.g. a pie chart or an Histogram) from the same main search, something like this:

index=your_index | stats count BY InstanceType

index=your_index | bin CPUCreditBalance span=5 | stats count BY CPUCreditBalance

About the alert, you can use the same search adding a condition:

index=your_index | table InstanceID InstanceType CPUCreditBalance | where CPUCreditBalance<30

and saving it as an alert configured to send an eMail; to do this you have to follow the guided procedure after "Save as an alert".

At the end I hint to follow the Splunk Search Tutorial https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchTutorial/WelcometotheSearchTutorial and the Splunk Fundamentals I training (it's free with the exception of the Certification Exam) (https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html) then you can find many interesting videos on YouTube.

Ciao.

Giuseppe

Thanks for your response @gcusello

Dhanaskv — Thu, 01 Apr 2021 08:46:47 GMT

Yes , already have the data in an index

topic Re: Anyone help me in Dashboards & Visualizations

Anyone help me

Re: Anyone help me

Thanks for your response @gcusello