Good morning
I am working on a Splunk dashboard where there's a site with 15 different firewall rules. I want to set up a single number that auto updates and shows that the rules are all active.
So it would be green at 15 and anything less, 14 -1 would should as yellow,
technically I would like if it drops before the half to go red but I'm fine with green and yellow for now.
I am doing index=firewallindexname sourcetyp=firewallsourcetype sensor=rule1 OR sensor=rule=2
and so on
This is where I hit the brick wall, I wanna do count- but not the count of the firewall rules used- just the fifteen different ones if they are active.
found my own answer, just use stats count, not stats count by.....
thanks
found my own answer, just use stats count, not stats count by.....
thanks