I need to create a dashboard to indicate the existence of several processes.
I have the Splunk *ix add-on providing the ps info I want, but am struggling with how to get this meaningfully onto a dashboard. All of the visualisations I can see are fine for numerical values, but I really only need a boolean one. Is there some kind of binary (such as red light/green light) visual I can use to indicate the presence of a process within the last set of ps data received?
Yes. You could go as far as this answer suggests
But there is an easier way, if you don't think that is necessary. First, in the search, set two fields (found
and range
in this example). Assume that you save this search with the name mySearch
yoursearchhere
| eval found=if(match(_raw,"regexofwhatyouwant"),"Found","Missing")
| eval range = if (found=="Found","low","severe")
Splunk makes the following color associations in the default.css for Single Value Panels
So we set range
to match low (green) or severe (red). To actually have this take effect, though, you need to create a dashboard and add this search to one of the dashboard panels. Make sure that you select the visualization called "Single" or "Single Value".
After the dashboard is created, edit the underlying simple XML. You can do this from the dashboard editor. In the simple XML, look for the <single>
tag and add the two option lines. (There may be other lines within the single
tag as well.)
<single>
<searchName>mySearch</searchName>
<title>Was the process found?</title>
<option name="classField">range</option>
<option name="field">found</option>
</single>
This will give you either the word "Found" in green or the word "Missing" in red.
Yes. You could go as far as this answer suggests
But there is an easier way, if you don't think that is necessary. First, in the search, set two fields (found
and range
in this example). Assume that you save this search with the name mySearch
yoursearchhere
| eval found=if(match(_raw,"regexofwhatyouwant"),"Found","Missing")
| eval range = if (found=="Found","low","severe")
Splunk makes the following color associations in the default.css for Single Value Panels
So we set range
to match low (green) or severe (red). To actually have this take effect, though, you need to create a dashboard and add this search to one of the dashboard panels. Make sure that you select the visualization called "Single" or "Single Value".
After the dashboard is created, edit the underlying simple XML. You can do this from the dashboard editor. In the simple XML, look for the <single>
tag and add the two option lines. (There may be other lines within the single
tag as well.)
<single>
<searchName>mySearch</searchName>
<title>Was the process found?</title>
<option name="classField">range</option>
<option name="field">found</option>
</single>
This will give you either the word "Found" in green or the word "Missing" in red.
Yes, you can combined results into a single panel: here is a link to the documentation
http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#row
Is there a way to put more than one of these in a single dashboard panel?
Fantastic, thank you!
I think I'll be able to extend it to look for more than one process quite easily.