Existence of multiple *ix processes dashboard

[wardallen]

I need to create a dashboard to indicate the existence of several processes.

I have the Splunk *ix add-on providing the ps info I want, but am struggling with how to get this meaningfully onto a dashboard. All of the visualisations I can see are fine for numerical values, but I really only need a boolean one. Is there some kind of binary (such as red light/green light) visual I can use to indicate the presence of a process within the last set of ps data received?

[lguinn2 · Accepted solution]

Yes. You could go as far as this answer suggests

How to show a custom icon

But there is an easier way, if you don't think that is necessary. First, in the search, set two fields (found and range in this example). Assume that you save this search with the name mySearch

yoursearchhere
| eval found=if(match(_raw,"regexofwhatyouwant"),"Found","Missing")
| eval range = if (found=="Found","low","severe")

Splunk makes the following color associations in the default.css for Single Value Panels

• low = green
• guarded = blue
• elevated = yellow
• high = orange
• severe = red

So we set range to match low (green) or severe (red). To actually have this take effect, though, you need to create a dashboard and add this search to one of the dashboard panels. Make sure that you select the visualization called "Single" or "Single Value".

After the dashboard is created, edit the underlying simple XML. You can do this from the dashboard editor. In the simple XML, look for the <single> tag and add the two option lines. (There may be other lines within the single tag as well.)

<single>
  <searchName>mySearch</searchName>
  <title>Was the process found?</title>
  <option name="classField">range</option>
  <option name="field">found</option>
</single>

This will give you either the word "Found" in green or the word "Missing" in red.

[lguinn2]

Yes, you can combined results into a single panel: here is a link to the documentation

http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#row

[wardallen]

Is there a way to put more than one of these in a single dashboard panel?

[wardallen]

Fantastic, thank you!

I think I'll be able to extend it to look for more than one process quite easily.