Dashboards & Visualizations

Existence of multiple *ix processes dashboard

wardallen
Path Finder

I need to create a dashboard to indicate the existence of several processes.

I have the Splunk *ix add-on providing the ps info I want, but am struggling with how to get this meaningfully onto a dashboard. All of the visualisations I can see are fine for numerical values, but I really only need a boolean one. Is there some kind of binary (such as red light/green light) visual I can use to indicate the presence of a process within the last set of ps data received?

Tags (1)
0 Karma
1 Solution

lguinn2
Legend

Yes. You could go as far as this answer suggests

How to show a custom icon

But there is an easier way, if you don't think that is necessary. First, in the search, set two fields (found and range in this example). Assume that you save this search with the name mySearch

yoursearchhere
| eval found=if(match(_raw,"regexofwhatyouwant"),"Found","Missing")
| eval range = if (found=="Found","low","severe")

Splunk makes the following color associations in the default.css for Single Value Panels

  • low = green
  • guarded = blue
  • elevated = yellow
  • high = orange
  • severe = red

So we set range to match low (green) or severe (red). To actually have this take effect, though, you need to create a dashboard and add this search to one of the dashboard panels. Make sure that you select the visualization called "Single" or "Single Value".

After the dashboard is created, edit the underlying simple XML. You can do this from the dashboard editor. In the simple XML, look for the <single> tag and add the two option lines. (There may be other lines within the single tag as well.)

<single>
  <searchName>mySearch</searchName>
  <title>Was the process found?</title>
  <option name="classField">range</option>
  <option name="field">found</option>
</single>

This will give you either the word "Found" in green or the word "Missing" in red.

View solution in original post

0 Karma

lguinn2
Legend

Yes. You could go as far as this answer suggests

How to show a custom icon

But there is an easier way, if you don't think that is necessary. First, in the search, set two fields (found and range in this example). Assume that you save this search with the name mySearch

yoursearchhere
| eval found=if(match(_raw,"regexofwhatyouwant"),"Found","Missing")
| eval range = if (found=="Found","low","severe")

Splunk makes the following color associations in the default.css for Single Value Panels

  • low = green
  • guarded = blue
  • elevated = yellow
  • high = orange
  • severe = red

So we set range to match low (green) or severe (red). To actually have this take effect, though, you need to create a dashboard and add this search to one of the dashboard panels. Make sure that you select the visualization called "Single" or "Single Value".

After the dashboard is created, edit the underlying simple XML. You can do this from the dashboard editor. In the simple XML, look for the <single> tag and add the two option lines. (There may be other lines within the single tag as well.)

<single>
  <searchName>mySearch</searchName>
  <title>Was the process found?</title>
  <option name="classField">range</option>
  <option name="field">found</option>
</single>

This will give you either the word "Found" in green or the word "Missing" in red.

0 Karma

lguinn2
Legend

Yes, you can combined results into a single panel: here is a link to the documentation

http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#row

0 Karma

wardallen
Path Finder

Is there a way to put more than one of these in a single dashboard panel?

0 Karma

wardallen
Path Finder

Fantastic, thank you!

I think I'll be able to extend it to look for more than one process quite easily.

0 Karma
Get Updates on the Splunk Community!

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...