All Apps and Add-ons

Dash board

RAYUDU_NARA
Explorer

I need one dash board for below data. Like in dash board i want to show, if response_code=200 it is Running if any other response_code it should be Stopped. Please give me the query for the dash board.

url=http://www.google.com/ response_code=200 content_size=2360 timed_out=False title="WCS UAT2 Prod site"

0 Karma
1 Solution

nickhills
Ultra Champion

So many ways to do this, but I would start with this:

<your search> | eval status=if(response_code=200,"Running","Stopped") |table title url status

Edit: Reference http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/CommonEvalFunctions#Compariso...

Edit 2: Changed single quotes to double.

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

nickhills
Ultra Champion

So many ways to do this, but I would start with this:

<your search> | eval status=if(response_code=200,"Running","Stopped") |table title url status

Edit: Reference http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/CommonEvalFunctions#Compariso...

Edit 2: Changed single quotes to double.

If my comment helps, please give it a thumbs up!
0 Karma

RAYUDU_NARA
Explorer

But in my data only response_code is there.

0 Karma

nickhills
Ultra Champion

Can you post your actual search, and the results it returns?

If my comment helps, please give it a thumbs up!
0 Karma

RAYUDU_NARA
Explorer

url=http://www.google.com/ content_sha224=d300f3403a5cdc4b8d8744824b94816e888a09466b66e8355dce537d total_time=8.56 request_time=8.56 content_md5=042f3f82acbef300711b1a4c07104a48 response_code=200 content_size=2360 timed_out=False title="WCS UAT2 Prod site"

0 Karma

nickhills
Ultra Champion

This works for me :

| makeresults 
| eval url="http://www.google.com/" 
| eval content_sha224="d300f3403a5cdc4b8d8744824b94816e888a09466b66e8355dce537dx" 
| eval total_time=8.56 
| eval request_time=8.56 
| eval content_md5="042f3f82acbef300711b1a4c07104a48" 
| eval response_code=200 
| eval content_size=2360 
| eval timed_out=False 
| eval title="WCS UAT2 Prod site" 


| eval status=if(response_code=200,"Running","Stopped") 
| table title url status response_code
If my comment helps, please give it a thumbs up!
0 Karma

nickhills
Ultra Champion

oh wait - typo in my previous post - the quotes should be double quotes - not single.

If my comment helps, please give it a thumbs up!
0 Karma

RAYUDU_NARA
Explorer

thanks, it is working.

0 Karma

niketn
Legend

@RAYUDU_NARA, please accept the Answer if your issue is resolved, and mark this question as answered!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...