How to display a marker gauge for each host showing the amount of today's logs?

[SecureIA]

Hi helpful people,

Is there a way of showing a marker gauge for each host in my network that shows the total amount of logs for the current day? I wish to display this on a dashboard so that we can easily determine whether a machine is outputting an abnormal amount of logs.

Any help would be truly appreciated.

[jplumsdaine22]

If you want to do it with markers, you will have to create a dashboard panel for each host. Each panel would have the following search

host=<your host> | stats count

Then just choose the marker guage visualization. If you want to view all your hosts side by side to look at abnormalities try

* |  stats count by host

and choose the line visualization.

But that's wasting Splunk's potential. Splunk can determine for you whether the volume is abnormal. For example, you could have Splunk alert you if a particular count is more than 3 standard deviations from the average - you'll never have to login again! (Although I understand every good NOC needs a dashboard full of numbers going up and down). Have a look at http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/CommonStatsFunctions for a list of statistical functions that you can apply to your data.