How to check if a service is running and display it in a dashboard

[timospringer]

Hello,

I want to check if a service on my client is running or not. I can check the service with the Windows System-Log.
This is working, but I don't find a way to display it in a dashboard.

If the service is running, there should be green indicator. If the service is not running, there should be a red indicator or something like that.

I am thankful for any tips!

[woodcock · Accepted solution]

Let us say that you have created a search that outputs a single row with 2 fields. One field is called host and the other status and status can have at least 2 values, one of which is OK. Use a search like this:

... | eval statusNum=if(status="OK",0,1) | rangemap field=statusNum low=0-0 severe=1-9999999 default=Severe

Click on the Visualization tab, click on the left-most menu and select "Single Value". You will see your host value in either red or green, depending on if it is "OK" (green) or not.

[somesoni2]

I'm assuming that you have the required data already in Splunk to identify that a service is running or not. You would have to write a query to get the latest status of the service OR services and you can see the Splunk 6 dashboard example app see the format and sample on how to do the same.

https://splunkbase.splunk.com/app/1603/