Hi @vamshi04,
you should create a lookup containing all the server to monitor (e.g. perimeter.csv) with a column called host.
then you could run a search like this:
index=_internal
| eval host=lower(host)
| stats count BY host
| append [ | inputlookup perimeter.csv | eval count=0, host=lower(host) | fields host count ]
| stats sum(count) AS total BY host
In this way all the hosts with total=0 are down and hosts with total>0 are up.
You can create a dashboard to display in graphic mode the situation:
<dashboard script="table_icons_rangemap.js" stylesheet="table_decorations.css">
<label>Table Icon Set (Rangemap)</label>
<description>Use Javascript and CSS in tables to convert rangemap results into icons.</description>
<row>
<table id="table1">
<title>Render Icons based on rangemap result</title>
<search>
<query>
index=_internal
| eval host=lower(host)
| stats count BY host
| append [ | inputlookup perimeter.csv | eval count=0, host=lower(host) | fields host count ]
| stats sum(count) AS total BY host
| rangemap field=total elevated=0-0 low=1-10000000000000 default=severe
</query>
<earliest>-1h</earliest>
</search>
<option name="drilldown">none</option>
</table>
</row>
</dashboard>
in which there are notable:
- in the first row a css and a js to call;
- the id=1 in table tag used by js;
- the rangemap command used to define the threesholds for the different levels and icons.
The instructions about css and js to use are in the Splunk Dashboard Examples App at Table Icon Set (Rangemap) dashboard.
Ciao.
Giuseppe
