https://community.splunk.com/t5/Reporting/Report-and-a-dashboard/m-p/418666#M9662 <P>@viji261992</P> <P>Can you please share sample events?</P> Sat, 06 Oct 2018 08:20:00 GMT kamlesh_vaghela 2018-10-06T08:20:00Z https://community.splunk.com/t5/Reporting/Report-and-a-dashboard/m-p/418665#M9661 <P>Our splunk is receiving events from network devices, which contains hostname, eventuei="error reason", eventtime.<BR /> 1. I need to create a report which display the hostname, corresponding error reason , eventtime and no. of alerts generated<BR /> 2. I need to create a dashboard with device name in the x-axis no. of alerts in the y-axis<BR /> 3. A complete dashboard which shows total no. of hosts in my company, no. of hosts working fine, no. of hosts are down based on error reason</P> Sat, 06 Oct 2018 07:57:31 GMT https://community.splunk.com/t5/Reporting/Report-and-a-dashboard/m-p/418665#M9661 viji261992 2018-10-06T07:57:31Z https://community.splunk.com/t5/Reporting/Report-and-a-dashboard/m-p/418666#M9662 <P>@viji261992</P> <P>Can you please share sample events?</P> Sat, 06 Oct 2018 08:20:00 GMT https://community.splunk.com/t5/Reporting/Report-and-a-dashboard/m-p/418666#M9662 kamlesh_vaghela 2018-10-06T08:20:00Z https://community.splunk.com/t5/Reporting/Report-and-a-dashboard/m-p/418667#M9663 <P>2018-10-06 08:33:04.248, eventid="160109240", eventuei="uei.opennms.org/XOM/threshold/wan_routers/int-rx-util-rearm", nodeid="15925", eventtime="2018-10-06 08:33:04.248", ipaddr="x.x.x.x", eventlogmsg="Interface Gi2/0/2 on GQEGJ-WANRTC002 RX (58.21%) exceeded threshold has cleared", eventseverity="3", alarmid="24607406", nodelabel="GQEGJ-WANRTC002"</P> <P>This is the log that we are getting from our tools<BR /> Search : index=opennms sourcetype=event</P> Sat, 06 Oct 2018 08:36:23 GMT https://community.splunk.com/t5/Reporting/Report-and-a-dashboard/m-p/418667#M9663 viji261992 2018-10-06T08:36:23Z https://community.splunk.com/t5/Reporting/Report-and-a-dashboard/m-p/418668#M9664 <P>@viji261992</P> <P>Can you please describe below fields? I need hostname , device name and correlation idea as per your requirement. </P> <P>alarmid<BR /> eventid<BR /> eventlogmsg<BR /> eventseverity<BR /> eventtime<BR /> eventuei<BR /> ipaddr<BR /> nodeid<BR /> nodelabel</P> Sat, 06 Oct 2018 08:56:24 GMT https://community.splunk.com/t5/Reporting/Report-and-a-dashboard/m-p/418668#M9664 kamlesh_vaghela 2018-10-06T08:56:24Z https://community.splunk.com/t5/Reporting/Report-and-a-dashboard/m-p/418669#M9665 <OL> <LI><CODE>index=opennms sourcetype=event | stats values(eval(strftime(_time,"%Y-%m-%dT%H:%M:%S"))) as time_new list(nodeid) as hostname count by eventuei</CODE> Note: The assumption here is that you have the hostnames in the field "nodeid"</LI> <LI><CODE>index=opennms sourcetype=event | stats values(nodeid) as hostname count by eventuei | fields - eventuei</CODE> after running this search go to the visualization tab and select chart type as "clolumn chart" and then save it as a dashboard</LI> <LI><CODE>index=opennms sourcetype=event | timechart span=1h distinct_count(nodeid) as hostcount</CODE> - for "total no. of hosts in my company" save it as a dashboard panel</LI> </OL> <P>i will look into it again when i have some more time, meanwhile can you check if the above searches work/meet your requirements.</P> Tue, 09 Oct 2018 13:09:21 GMT https://community.splunk.com/t5/Reporting/Report-and-a-dashboard/m-p/418669#M9665 soumyasaha25 2018-10-09T13:09:21Z