How to display the below query results in a better way on a dashboard?
| metasearch index=_internal | eval host=lower(host) | stats count BY host | append [ | inputlookup perimeter | eval host=lower(host), count=0 | fields host count ] | stats sum(count) AS total BY host | eval status=if(total=0,"Down","Up") | table host status
Depends on how many you have in that table - what do you want to convey?
You can colour the Status column green/red for up/down
You could do a
| stats values(host) as Hosts by Status
to have a single value field for all the up/down hosts and then colour the row accordingly using one of the simple JS extensions from the dashboard examples.
You could display a simple percentage counter of those hosts up vs down and then drilldown into the relevant category - in that way you're not displaying a list of names any more, you're representing a metric, in which case you can then use different visualisations to show that ratio.
But it all depends on your viewpoint of 'better'
Hi @Uday,
as I said in a different answer, install the Splunk Dashboard Examples App.
Then copy in $SPLUNK_HOME/etx/apps/your_app/ two files that you can find in the app:
and then (after Splunk restart) try something like this:
<form script="table_icons_rangemap.js" stylesheet="table_decorations.css">
<label>Home Page</label>
<fieldset submitButton="false">
<input type="time" token="Time">
<label>periodo</label>
<default>
<earliest>@d</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<title>Servers</title>
<table id="table1">
<title>Total = $server_count$</title>
<search>
<progress>
<set token="server_count">$job.resultCount$</set>
</progress>
<cancelled>
<unset token="server_count"></unset>
</cancelled>
<query>
| metasearch index=_internal
| eval host=lower(host)
| stats count BY host
| append [ | inputlookup perimeter | eval host=lower(host), count=0 | fields host count ]
| stats sum(count) AS total BY host
| eval status=if(total=0,"Down","Up")
| table host status
</query>
<earliest>$Time.earliest$</earliest>
<latest>$Time.latest$</latest>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</form>
Ciao.
Giuseppe