Dashboards & Visualizations

Dashboard to track server status

sizemorejm
Explorer

Hello,

I am attempting to make a dashboard that will simply show if a host/server is up or down. Basically have a box that is green or red for each server.  Most threads I have seen are fairly old so I am hoping there is a an easier way to show this in either XML or in Dashboard Studio.  

Thanks

Labels (2)
0 Karma

meetmshah
SplunkTrust
SplunkTrust

Hello @sizemorejm,

Yes, I have just provided a demo server in the XML file and have used the makeresults command to have a dummy value available.

In an actual environment, you will need to get the status and update the colours based on the values. Do you need assistance with writing the actual search? If so, can you provide additional information like sample events etc.?

0 Karma

sizemorejm
Explorer

Some events I have are "cpu" and "vmstat"

0 Karma

sizemorejm
Explorer

Im using the Unix and Linux Add-On overview if that helps

0 Karma

meetmshah
SplunkTrust
SplunkTrust

Can you please share search / Dashboard XML?

0 Karma

sizemorejm
Explorer

I have nothing different from what you linked initially , the only issue i am having is to configure a search to determine the status, should I use a metric that monitors CPU usage and determine the status based on that? 

0 Karma

sizemorejm
Explorer

Do you have a suggestion for a metric to monitor to determine if a host is up/down?

0 Karma

meetmshah
SplunkTrust
SplunkTrust

I believe "script://./bin/uptime.sh" inputs would help you.

0 Karma

meetmshah
SplunkTrust
SplunkTrust

Hello @sizemorejm,

You can get the results in the table format and use Color formatting with static values like below - 

meetmshah_0-1689915551288.png

 

Here is the demo XML - 

<dashboard version="1.1">
  <label>Test1</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| eval host="abc", status="active"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="status">
          <colorPalette type="map">{"active":#118832,"inactive":#115BAD}</colorPalette>
        </format>
      </table>
    </panel>
  </row>
</dashboard>

 

Please accept the solution and hit Karma, if this helps!

0 Karma

sizemorejm
Explorer

I am trying to test this code out for hosts that I know are active and inactive and it can not tell if a server is inactive. is this because of the search?

0 Karma

sizemorejm
Explorer


I am not sure if I am misunderstand or not but is this search causing it to automatically assume the server is active?

 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...