Dashboards & Visualizations

How do you create a dashboard by event correlation?

saadi381
New Member

Hi

Apologies if this has been asked before.

So here is what i am trying to achieve

  1. Catch the log and create an event like when bgp goes down (easy can search and filter them out)
  2. Catch the log and create if above event is clear , will get a log message with status Up
  3. Correlate both events
  4. Display in a dashboard when event happened and keep it there unless the clear event is not received

So basically a dashboard where i can see when bgp goes down and if it is down , if restored the event to disappear from dashboard.

Not sure if possible in Splunk and how to do it

Here are sample logs which i need to correlate

Nov 11 15:39:05 hostanme1 -  RPD_BGP_NEIGHBOR_STATE_CHANGED: BGP peer 192.168.200.146 (External AS 12345) changed state from Established to Idle (event HoldTime) (instance vrf-1234)

After above log i need to display an event in dashboard

Nov 11 15:43:00 hostanme1 -  RPD_BGP_NEIGHBOR_STATE_CHANGED: BGP peer 192.168.200.146 (External AS 12345) changed state from OpenConfirm to Established (event RecvKeepAlive) (instance vrf-1234)

After above log i want to clear the event

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@saadi381,

Assuming IP can be used to correlate the events, give this a try

"your base search"
|rex field=_raw "BGP peer (?<IP>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})"
|rex field=_raw "from \w+\sto\s(?<status>\w+)"
|stats count,latest(_raw) as _raw,latest(status) as Status by IP
|where count<2 AND Status!="Established"

This should leave with only idle IPs. Test it by removing the last where clause.

Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@saadi381,

Assuming IP can be used to correlate the events, give this a try

"your base search"
|rex field=_raw "BGP peer (?<IP>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})"
|rex field=_raw "from \w+\sto\s(?<status>\w+)"
|stats count,latest(_raw) as _raw,latest(status) as Status by IP
|where count<2 AND Status!="Established"

This should leave with only idle IPs. Test it by removing the last where clause.

Happy Splunking!
0 Karma

saadi381
New Member

i think its working , thanks a heap for this , i will test it for next 24hours to verify

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@saadi381,

Its possible. Do you have a unique field in both events to correlate them (router id or something)? Would be helpful if you could provide some sample events (mask any confidential data). Also how do you want to represent in the dashboard? Just as events or some status indicator?

Happy Splunking!
0 Karma

saadi381
New Member

added sample logs

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...