Dash board

[RAYUDU_NARA]

I need one dash board for below data. Like in dash board i want to show, if response_code=200 it is Running if any other response_code it should be Stopped. Please give me the query for the dash board.

url=http://www.google.com/ response_code=200 content_size=2360 timed_out=False title="WCS UAT2 Prod site"

[nickhills · Accepted solution]

So many ways to do this, but I would start with this:

<your search> | eval status=if(response_code=200,"Running","Stopped") |table title url status

Edit: Reference http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/CommonEvalFunctions#Compariso...

Edit 2: Changed single quotes to double.

[RAYUDU_NARA]

But in my data only response_code is there.

[nickhills]

Can you post your actual search, and the results it returns?

[RAYUDU_NARA]

url=http://www.google.com/ content_sha224=d300f3403a5cdc4b8d8744824b94816e888a09466b66e8355dce537d total_time=8.56 request_time=8.56 content_md5=042f3f82acbef300711b1a4c07104a48 response_code=200 content_size=2360 timed_out=False title="WCS UAT2 Prod site"

[nickhills]

This works for me :

| makeresults 
| eval url="http://www.google.com/" 
| eval content_sha224="d300f3403a5cdc4b8d8744824b94816e888a09466b66e8355dce537dx" 
| eval total_time=8.56 
| eval request_time=8.56 
| eval content_md5="042f3f82acbef300711b1a4c07104a48" 
| eval response_code=200 
| eval content_size=2360 
| eval timed_out=False 
| eval title="WCS UAT2 Prod site" 


| eval status=if(response_code=200,"Running","Stopped") 
| table title url status response_code

[nickhills]

oh wait - typo in my previous post - the quotes should be double quotes - not single.

[RAYUDU_NARA]

thanks, it is working.

[niketn]

@RAYUDU_NARA, please accept the Answer if your issue is resolved, and mark this question as answered!