Dashboards & Visualizations

How to create a search for the dashboard to show last event from each source?

ng87
Path Finder

We have an index that reads in log files from disk. Each logfile is its own source under the index, I want to create a basic health dashboard that shows the source name and when the last event/log was received and in the perfect world turn red if the last log was received more than x hours ago.

I currently have this set up with a single dashboard for each source, however, I would like to try and consolidate into a single dashboard.

Any help would be amazing

0 Karma
1 Solution

adonio
Ultra Champion

maybe a single panel will do,
try out this search:

| tstats max(_time) as last_event where index=* by source
| eval last_event_human = strftime(last_event, "%c")
| eval now = now()
| eval diff_in_seconds = now - last_event
| eval alert = if(diff_in_seconds>10,"alert","OK")

change the index=* to your index
feel free to change the alert value (here 10 seconds) to your desired value

hope it helps

View solution in original post

adonio
Ultra Champion

maybe a single panel will do,
try out this search:

| tstats max(_time) as last_event where index=* by source
| eval last_event_human = strftime(last_event, "%c")
| eval now = now()
| eval diff_in_seconds = now - last_event
| eval alert = if(diff_in_seconds>10,"alert","OK")

change the index=* to your index
feel free to change the alert value (here 10 seconds) to your desired value

hope it helps

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!