Dashboards & Visualizations

How do you create a dashboard by event correlation?

saadi381
New Member

Hi

Apologies if this has been asked before.

So here is what i am trying to achieve

  1. Catch the log and create an event like when bgp goes down (easy can search and filter them out)
  2. Catch the log and create if above event is clear , will get a log message with status Up
  3. Correlate both events
  4. Display in a dashboard when event happened and keep it there unless the clear event is not received

So basically a dashboard where i can see when bgp goes down and if it is down , if restored the event to disappear from dashboard.

Not sure if possible in Splunk and how to do it

Here are sample logs which i need to correlate

Nov 11 15:39:05 hostanme1 -  RPD_BGP_NEIGHBOR_STATE_CHANGED: BGP peer 192.168.200.146 (External AS 12345) changed state from Established to Idle (event HoldTime) (instance vrf-1234)

After above log i need to display an event in dashboard

Nov 11 15:43:00 hostanme1 -  RPD_BGP_NEIGHBOR_STATE_CHANGED: BGP peer 192.168.200.146 (External AS 12345) changed state from OpenConfirm to Established (event RecvKeepAlive) (instance vrf-1234)

After above log i want to clear the event

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@saadi381,

Assuming IP can be used to correlate the events, give this a try

"your base search"
|rex field=_raw "BGP peer (?<IP>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})"
|rex field=_raw "from \w+\sto\s(?<status>\w+)"
|stats count,latest(_raw) as _raw,latest(status) as Status by IP
|where count<2 AND Status!="Established"

This should leave with only idle IPs. Test it by removing the last where clause.

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@saadi381,

Assuming IP can be used to correlate the events, give this a try

"your base search"
|rex field=_raw "BGP peer (?<IP>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})"
|rex field=_raw "from \w+\sto\s(?<status>\w+)"
|stats count,latest(_raw) as _raw,latest(status) as Status by IP
|where count<2 AND Status!="Established"

This should leave with only idle IPs. Test it by removing the last where clause.

View solution in original post

0 Karma

saadi381
New Member

i think its working , thanks a heap for this , i will test it for next 24hours to verify

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@saadi381,

Its possible. Do you have a unique field in both events to correlate them (router id or something)? Would be helpful if you could provide some sample events (mask any confidential data). Also how do you want to represent in the dashboard? Just as events or some status indicator?

0 Karma

saadi381
New Member

added sample logs

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.