Dashboards & Visualizations

How do I create a dashboard visualization that is single pane, 4 statuses? : (Stopping, Stopped, Starting, Started)

gaurav_ramteke
Explorer

Hi Guys,

Working on one PoC and week in search commands
After extracting fields i get four search strings as given below for an individual service status

  • index=* sourcetype=* service_status="*Core Stopping"
  • index=* sourcetype=* service_status="*Core Stopped"
  • index=* sourcetype=* service_status="*Core Starting"
  • index=* sourcetype=* service_status="*Core Started"

I want to create a dashboard (visualization of the service status) (Single pane 4 status): (Stopping, Stopped, Starting, Started)

please help

Thanks and Appreciated

0 Karma
1 Solution

efavreau
Motivator

I'm not clear on exactly what you're looking for, but maybe it's one of these two possabilities:
You are looking for the number of times you want to know each service status has occurred. If so, then look at the following run anywhere example that will pull the number of events for some sourcetypes in Splunk's _internal index.

index=_internal sourcetype="*d_access" OR sourcetype="*d_ui_access" OR sourcetype="*k_web_access" earliest="-1m@m" latest="@m"
| stats count BY sourcetype

After running this, go to the Visualization tab, select "Single Value", then click "Trellis" and you would get the count for each sourcetype in one visualization for a single panel in your dashboard.

If you meant you wanted the single value to indicate the current status based on whenever the search was ran, and one of the 4 types of service_status would be shown. Then we can use a case statement to rename the event as we need to match it, and get the last event. This is the most recent status.

index=_internal sourcetype="*d_access" OR sourcetype="*d_ui_access" OR sourcetype="*k_web_access" earliest="-1m@m" latest="@m" 
| eval sourcetype=case(
    sourcetype LIKE "%ui%","UI was the last event",
    sourcetype LIKE "%web%","WEB was the last event",
    sourcetype LIKE "%","splunkd_access was the last event"
    ) 
| stats last(sourcetype)

Then you go to the visualization tab, select "Single Value". You could then use this as a panel, where the status would change based on the timeframe the search was ran.

###

If this reply helps you, an upvote would be appreciated.

View solution in original post

efavreau
Motivator

I'm not clear on exactly what you're looking for, but maybe it's one of these two possabilities:
You are looking for the number of times you want to know each service status has occurred. If so, then look at the following run anywhere example that will pull the number of events for some sourcetypes in Splunk's _internal index.

index=_internal sourcetype="*d_access" OR sourcetype="*d_ui_access" OR sourcetype="*k_web_access" earliest="-1m@m" latest="@m"
| stats count BY sourcetype

After running this, go to the Visualization tab, select "Single Value", then click "Trellis" and you would get the count for each sourcetype in one visualization for a single panel in your dashboard.

If you meant you wanted the single value to indicate the current status based on whenever the search was ran, and one of the 4 types of service_status would be shown. Then we can use a case statement to rename the event as we need to match it, and get the last event. This is the most recent status.

index=_internal sourcetype="*d_access" OR sourcetype="*d_ui_access" OR sourcetype="*k_web_access" earliest="-1m@m" latest="@m" 
| eval sourcetype=case(
    sourcetype LIKE "%ui%","UI was the last event",
    sourcetype LIKE "%web%","WEB was the last event",
    sourcetype LIKE "%","splunkd_access was the last event"
    ) 
| stats last(sourcetype)

Then you go to the visualization tab, select "Single Value". You could then use this as a panel, where the status would change based on the timeframe the search was ran.

###

If this reply helps you, an upvote would be appreciated.

gaurav_ramteke
Explorer

Thank you efavreau

This helped me and its working now its just me to play around the colors
Much Appreciate 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...