Dashboards & Visualizations

How do I create a chart of Windows host status

stevenbutterwor
Path Finder

I would like to create a visualisation of my Windows hosts and their status over time.

e.g. something like this:

sourcetype=WinHostMon | timechart values(Status) by Host

Ideally I would like to see a table or graph that shows the up/down status of each host over a week

Tags (1)
0 Karma

P_vandereerden
Splunk Employee
Splunk Employee

Better late than never:

Assuming your windows host monitoring polls the hosts at regular intervals and logs a success or failure, and if you want a simple line chart with values 1 for up and 0 for down in some interval (say 10 minutes), you could do this:

sourcetype=WinHostMon
|  eval status_num=if(Status="up",1,0)
|  timechart span=10m min(status_num) by Host

Paul van der Eerden,
Breaking software for over 20 years.
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...