Dashboards & Visualizations

How to check if a service is running and display it in a dashboard

timospringer
New Member

Hello,

I want to check if a service on my client is running or not. I can check the service with the Windows System-Log.
This is working, but I don't find a way to display it in a dashboard.

If the service is running, there should be green indicator. If the service is not running, there should be a red indicator or something like that.

I am thankful for any tips!

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

Let us say that you have created a search that outputs a single row with 2 fields. One field is called host and the other status and status can have at least 2 values, one of which is OK. Use a search like this:

... | eval statusNum=if(status="OK",0,1) | rangemap field=statusNum low=0-0 severe=1-9999999 default=Severe

Click on the Visualization tab, click on the left-most menu and select "Single Value". You will see your host value in either red or green, depending on if it is "OK" (green) or not.

View solution in original post

woodcock
Esteemed Legend

Let us say that you have created a search that outputs a single row with 2 fields. One field is called host and the other status and status can have at least 2 values, one of which is OK. Use a search like this:

... | eval statusNum=if(status="OK",0,1) | rangemap field=statusNum low=0-0 severe=1-9999999 default=Severe

Click on the Visualization tab, click on the left-most menu and select "Single Value". You will see your host value in either red or green, depending on if it is "OK" (green) or not.

somesoni2
Revered Legend

I'm assuming that you have the required data already in Splunk to identify that a service is running or not. You would have to write a query to get the latest status of the service OR services and you can see the Splunk 6 dashboard example app see the format and sample on how to do the same.

https://splunkbase.splunk.com/app/1603/

0 Karma
Get Updates on the Splunk Community!

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...

Stay Connected: Your Guide to October Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...