Dashboards & Visualizations

How to use count for activity updates

jsalsbur
Explorer

Good morning
I am working on a Splunk dashboard where there's a site with 15 different firewall rules. I want to set up a single number that auto updates and shows that the rules are all active.
So it would be green at 15 and anything less, 14 -1 would should as yellow,
technically I would like if it drops before the half to go red but I'm fine with green and yellow for now.

I am doing index=firewallindexname sourcetyp=firewallsourcetype sensor=rule1 OR sensor=rule=2 and so on
This is where I hit the brick wall, I wanna do count- but not the count of the firewall rules used- just the fifteen different ones if they are active.

0 Karma
1 Solution

jsalsbur
Explorer

found my own answer, just use stats count, not stats count by.....

thanks

View solution in original post

0 Karma

jsalsbur
Explorer

found my own answer, just use stats count, not stats count by.....

thanks

View solution in original post

0 Karma