https://community.splunk.com/t5/Dashboards-Visualizations/To-create-dashboard-for-win-EventIDs/m-p/679464#M55650 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp; i created like this,</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="phanikumarcs_0-1709550109831.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/29580i25AA651AA1B859EB/image-size/medium?v=v2&amp;px=400" role="button" title="phanikumarcs_0-1709550109831.png" alt="phanikumarcs_0-1709550109831.png" /></span></P><P>in the Event Types</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="phanikumarcs_1-1709550169832.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/29581i7DAE19F160FBCEDE/image-size/medium?v=v2&amp;px=400" role="button" title="phanikumarcs_1-1709550169832.png" alt="phanikumarcs_1-1709550169832.png" /></span></P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="phanikumarcs_2-1709550206426.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/29582iEE744BF8055B4A9E/image-size/medium?v=v2&amp;px=400" role="button" title="phanikumarcs_2-1709550206426.png" alt="phanikumarcs_2-1709550206426.png" /></span></P><P>&nbsp;</P><P><SPAN>index=foo_win*&nbsp; (host="PC*" EventID=1068) OR (host="PR**" EventID="1") OR (host="PR*" EventID="1") OR (host="PR*" EventID="1")<BR /></SPAN>| eval Severity=case(EventID="1068", "Warning",<BR />EventID="1", "Information",<BR />EventID="1021", "Warning")<BR />| stats count by Severity<BR /><BR />writing above spl under all three pannels(critical, warning,information)<BR /><BR /></P> Mon, 04 Mar 2024 11:08:47 GMT phanikumarcs 2024-03-04T11:08:47Z https://community.splunk.com/t5/Dashboards-Visualizations/To-create-dashboard-for-win-EventIDs/m-p/679452#M55648 <P>Hi <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a><BR /><BR />need help, how many ways to show up in the dashboard where the eventids<BR /><BR />index=foo_win*&nbsp; (host="PC*" EventID=1068) OR (host="PR**" EventID="1") OR (host="PR*" EventID="1") OR (host="PR*" EventID="1").......<BR />where _time, server(host), eventid, severity (warning, critical, info)<BR /><BR /></P><P>Desired to achieve like below snap.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="phanikumarcs_0-1709545349110.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/29579i16F1DAD489D76470/image-size/medium?v=v2&amp;px=400" role="button" title="phanikumarcs_0-1709545349110.png" alt="phanikumarcs_0-1709545349110.png" /></span></P><P>&nbsp;</P> Mon, 04 Mar 2024 09:44:43 GMT https://community.splunk.com/t5/Dashboards-Visualizations/To-create-dashboard-for-win-EventIDs/m-p/679452#M55648 phanikumarcs 2024-03-04T09:44:43Z https://community.splunk.com/t5/Dashboards-Visualizations/To-create-dashboard-for-win-EventIDs/m-p/679457#M55649 <P>For each panel, what search are you using or going to use?</P> Mon, 04 Mar 2024 10:31:23 GMT https://community.splunk.com/t5/Dashboards-Visualizations/To-create-dashboard-for-win-EventIDs/m-p/679457#M55649 ITWhisperer 2024-03-04T10:31:23Z https://community.splunk.com/t5/Dashboards-Visualizations/To-create-dashboard-for-win-EventIDs/m-p/679464#M55650 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp; i created like this,</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="phanikumarcs_0-1709550109831.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/29580i25AA651AA1B859EB/image-size/medium?v=v2&amp;px=400" role="button" title="phanikumarcs_0-1709550109831.png" alt="phanikumarcs_0-1709550109831.png" /></span></P><P>in the Event Types</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="phanikumarcs_1-1709550169832.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/29581i7DAE19F160FBCEDE/image-size/medium?v=v2&amp;px=400" role="button" title="phanikumarcs_1-1709550169832.png" alt="phanikumarcs_1-1709550169832.png" /></span></P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="phanikumarcs_2-1709550206426.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/29582iEE744BF8055B4A9E/image-size/medium?v=v2&amp;px=400" role="button" title="phanikumarcs_2-1709550206426.png" alt="phanikumarcs_2-1709550206426.png" /></span></P><P>&nbsp;</P><P><SPAN>index=foo_win*&nbsp; (host="PC*" EventID=1068) OR (host="PR**" EventID="1") OR (host="PR*" EventID="1") OR (host="PR*" EventID="1")<BR /></SPAN>| eval Severity=case(EventID="1068", "Warning",<BR />EventID="1", "Information",<BR />EventID="1021", "Warning")<BR />| stats count by Severity<BR /><BR />writing above spl under all three pannels(critical, warning,information)<BR /><BR /></P> Mon, 04 Mar 2024 11:08:47 GMT https://community.splunk.com/t5/Dashboards-Visualizations/To-create-dashboard-for-win-EventIDs/m-p/679464#M55650 phanikumarcs 2024-03-04T11:08:47Z https://community.splunk.com/t5/Dashboards-Visualizations/To-create-dashboard-for-win-EventIDs/m-p/679465#M55651 <P>OK so it is not clear what you are asking for. Please can you expand on your usecase and the issue(s) you are facing?</P> Mon, 04 Mar 2024 11:13:46 GMT https://community.splunk.com/t5/Dashboards-Visualizations/To-create-dashboard-for-win-EventIDs/m-p/679465#M55651 ITWhisperer 2024-03-04T11:13:46Z