Dashboards & Visualizations

Creating a Splunk Dashboard by writing Splunk query

ngwodo
Path Finder

This is the 2 splunk query that I have:

| tstats latest(_time) as latest where index=* earliest=-48h by host
| eval minutesago=round((now()-latest)/60,0)

| tstats latest(_time) as latest where index=* earliest=-10m by host
| eval minutesago=round((now()-latest)/60,0)

 

I need the Splunk Query to do the following:

 

The log feeds by the actual device products instead of just IPs.

Deeper review of the logs by sourcetypes and sources (not just index=*) given that some tools are sending multiple feeds that are stored on  the same index files.

Tracking short term and long term outages instead of just last 10 min and last 24 hrs.

The use of charts to show visual state of the devices health check instead of tables.

Line charts to show logs feeds baseline vs spikes for last 24hrs/7d/30d.

Ability to drill down under specific stats.

Assets pivoting from an IP/hostname to show full device info (there are multiple lookup tables that have the necessary data).

 

Please I need your help with the splunk query to do the above task.

 

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Did you not get the magic wand with your starter pack?

You have a lot of requirements there. Start with the one you think is easiest and build from there. The more you play with splunk and your data, the better you will understand both, and the more you will be able to do with both. Alternatively, find a budget and hire some professional services.

0 Karma

ngwodo
Path Finder

Thanks the starter pack works. I am working on building on it since I have more broader requirements.

0 Karma

ngwodo
Path Finder

Please is there anyway you can assist me with any of those?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Of those requirements, I would probably start by counting the number of log entries per hour or minute and chart that. Then you will get an idea of the shape of the data you are receiving. Then decide what useful information you want out of that.

0 Karma

ngwodo
Path Finder

Thanks for your help. I will work on it and probably may have questions. Thanks again.

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...