Dashboards & Visualizations

Anyone help me

Path Finder

My task

1. Prepare a new dashboard that shows the following:

2. Need to shows the new dashboard ----> InstanceID, InstanceType,CPUCreditBalance

3.I need to write a Splunk alert on a condition like

4. CPU credit balance < 30 then send alert email

Labels (1)
0 Karma


Hi @Dhanaskv,

your request is just a little vague...

Anyway, supposing that you already have the data in an index (otherwise you have to start from the beginning your approach to Splunk), you have to create the main search to use both for the dashboard and the alert.

Remember that everything in Splunk starts from a search!

so you have to find your search having something like this:

| table InstanceID InstanceType CPUCreditBalance

(I suppose that you already extracted fields, otherwise you have to do this before.)

Taking the above search you can save it in a dashboard's panel, adding also some filter; in this way  you have your dashboard, that you could also enrich adding some statistics (e.g. a pie chart or an Histogram) from the same main search, something like this:

| stats count BY InstanceType 


| bin CPUCreditBalance span=5
| stats count BY CPUCreditBalance

 About the alert, you can use the same search adding a condition:

| table InstanceID InstanceType CPUCreditBalance
| where CPUCreditBalance<30

and saving it as an alert configured to send an eMail; to do this you have to follow the guided procedure after "Save as an alert".

At the end I hint to follow the Splunk Search Tutorial https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchTutorial/WelcometotheSearchTutorial and the Splunk Fundamentals I training (it's free with the exception of the Certification Exam) (https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html) then you can find many interesting videos on YouTube.



0 Karma

Path Finder

Yes , already have the data in an index 

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...