Dashboards & Visualizations

How to show computer in horizontal chart event if there are 0 events

LyDang
Explorer

I want to have a graph where where you can easily see when that system is no longer taking kerberos authentications.  But when it doesn't show anything for over 12h, then that object is no longer in that graph. Is there a way to keep my servers showing even if there are 0 events for that time period?

index=perfmon source="Perfmon:Security System-Wide Statistics" counter="Kerberos Authentications" earliest=-12h latest=now
[inputlookup Prod_DC.csv]
| eval host=lower(host)
|bucket span=5m time | stats count by _time,host|eval count=if(count>0,1,0)
|timechart span=5m limit=0 last(count) by host

Labels (3)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

This is another way of appending the columns for any MISSING hosts entirely.

The first timechart + fillnull will create the gaps for all hosts found, but then the final appendcols will add in columns for any missing hosts

| makeresults count=50
| eval _time=now()-((random() % 62) * 60)
| eval host=mvindex(split("hosta,hostb,hostc",","), random() % 3) 
| bin _time span=5m 
| stats count by _time,host
| eval count=if(count>0,1,0)
|timechart span=5m limit=0 last(count) by host
| fillnull
| appendcols [
  | makeresults
  | eval host=split("hosta,hostb,hostc,hostd",",")
  | mvexpand host
  | eval count=0
  | chart values(count) as count over _time by host
]
| filldown

 Hopefully these will give you something to work with

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

To show something that doesn't exist means you have to add that 'known' component back in. That means after your search you have to add back all the hosts you expect to see. If your hosts are in Prod_DC.csv you will need to append that data then massage the results with something like the method below for a simple stats collection

....
| append [
  | inputlookup Prod_DC.csv
  | eval count=0
]
| stats max(count) as count by host

 

0 Karma

LyDang
Explorer

The problem is that I have:

|bucket span=5m time | stats count by _time,host|eval count=if(count>0,1,0)

I think this put events in 5m time slots.

 

I want a chart that will tell me every 5 minutes if 1/There are any events or 2/There are 0 events.

Also to have the server on the list if 0 events for that 12 hours.

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

This is another way of appending the columns for any MISSING hosts entirely.

The first timechart + fillnull will create the gaps for all hosts found, but then the final appendcols will add in columns for any missing hosts

| makeresults count=50
| eval _time=now()-((random() % 62) * 60)
| eval host=mvindex(split("hosta,hostb,hostc",","), random() % 3) 
| bin _time span=5m 
| stats count by _time,host
| eval count=if(count>0,1,0)
|timechart span=5m limit=0 last(count) by host
| fillnull
| appendcols [
  | makeresults
  | eval host=split("hosta,hostb,hostc,hostd",",")
  | mvexpand host
  | eval count=0
  | chart values(count) as count over _time by host
]
| filldown

 Hopefully these will give you something to work with

LyDang
Explorer

That works for me! Many thanks 😀

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Here's one example of how to fill in gaps

| makeresults count=50
| eval _time=now()-((random() % 60) * 60)
| eval host=mvindex(split("hosta,hostb,hostc",","), random() % 3) 
| bin _time span=5m 
| stats count by _time,host
| eval count=if(count>0,1,0)
| append [
  | makeresults
  | eval host=split("hosta,hostb,hostc",",")
  | addinfo
  | eval time_window = info_max_time - info_min_time
  | eval bin_count = round(time_window / 300)
  | mvexpand host
  | eval bins=mvrange(1, bin_count + 1, 1)
  | mvexpand bins
  | eval _time=now() - (bins * 300)
  | eval count = 0, dummy=1
  | fields _time host count 
]
| bin _time span=5m 
| stats max(count) as count by _time,host
|timechart span=5m limit=0 last(count) by host

It generates the additional check data in the append by taking all the 'known' hosts and creating extra rows on the end for each 5 minute bin within the search window, and then stats joins them back together - then you can use your timechart at the end

There's probably another way to fill the gaps - there always is with Splunk

 

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...