Dashboards & Visualizations

Need a query /dashboard that shows hostnames from /var/log/messages

dops1992
New Member

We have an index called syslog and we want to capture certain errors and report them in a dashboard with a graph as well as a table below that . Was wondering how to do that . I tried to add a dashboard and a panel but it only shows the graph.

Example

index=log host=pprdabcdek01 "reports path is down" this works great for one host
index=log host=pprd*k* OR host=pprd***l "tur checker reports path is down"| timechart count by host (This also works great but not sure if it is efficient) . Woudl like a better query that will cover more hosts like
pprdefghk01 or pprdabcask04 or pprderedbl01 or pprdrrsasl04 etc .....

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The easy option would be to cover all hosts, and remove the host= filter.

If you only want to view a set of hosts I'd recommend storing that set in a lookup file, and either filtering by an automatic lookup output field or using a subsearch like index=log [inputlookup that_lookup | fields host] ....

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...