Dashboard for Server Status

[Uday]

How to display the below query results in a better way on a dashboard?

| metasearch index=_internal
| eval host=lower(host)
| stats count BY host
| append [ | inputlookup perimeter | eval host=lower(host), count=0 | fields host count ]
| stats sum(count) AS total BY host
| eval status=if(total=0,"Down","Up")
| table host status

[bowesmana]

Depends on how many you have in that table - what do you want to convey?

You can colour the Status column green/red for up/down

You could do a 

| stats values(host) as Hosts by Status

to have a single value field for all the up/down hosts and then colour the row accordingly using one of the simple JS extensions from the dashboard examples.

You could display a simple percentage counter of those hosts up vs down and then drilldown into the relevant category - in that way you're not displaying a list of names any more, you're representing a metric, in which case you can then use different visualisations to show that ratio.

But it all depends on your viewpoint of 'better'

[gcusello]

Hi @Uday,

as I said in a different answer, install the Splunk Dashboard Examples App.

Then copy in $SPLUNK_HOME/etx/apps/your_app/ two files that you can find in the app:

• "table_icons_rangemap.js",
• "table_decorations.css"

and then (after Splunk restart) try something like this:

<form script="table_icons_rangemap.js" stylesheet="table_decorations.css">
  <label>Home Page</label>
  <fieldset submitButton="false">
    <input type="time" token="Time">
      <label>periodo</label>
      <default>
        <earliest>@d</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Servers</title>
      <table id="table1">
        <title>Total = $server_count$</title>
        <search>
          <progress>
            <set token="server_count">$job.resultCount$</set>
          </progress>
          <cancelled>
            <unset token="server_count"></unset>
          </cancelled>
          <query>
            | metasearch index=_internal
            | eval host=lower(host)
            | stats count BY host
            | append [ | inputlookup perimeter | eval host=lower(host), count=0 | fields host count ]
            | stats sum(count) AS total BY host
            | eval status=if(total=0,"Down","Up")
            | table host status
          </query>
          <earliest>$Time.earliest$</earliest>
          <latest>$Time.latest$</latest>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

 Ciao.

Giuseppe