Dashboards & Visualizations

Sort and compare message_text - noob needs help

FinnHatlen
Engager

Hello, I have this new task that I'm not sure how to go about it. I'm new to splunk so any help is really appreciated. 

I want to create a dashboard that monitors all power issues that's been logged, as well as a dashboard for all remaining issues based on the message text below: 

host_name=Contoso* OR host_name=Kontoso* AND message_text="Power supply 1 has failed or been turned off"
OR message_text="Power supply 1 is okay" OR message_text="Power supply 2 has failed or been turned off" OR message_text="Power supply 2 is okay"
OR "Power-module 0/PS0/M1/SP failure condition cleared" OR "0/PS0/M1/SP, state: FAILED"

First off, the field "message_text" only captured four out of six messages, so these two were left out: 
"Power-module 0/PS0/M1/SP failure condition cleared" OR "0/PS0/M1/SP, state: FAILED"

I tried to see if i could create a new or update message_text to include these two, but it looked like it just added it to a new field that I couldn't find when I used the same filter afterwards. 

Is it here that I use the eval-function to compare and remove logs that has been cleared? 

Labels (1)
0 Karma

ashajambagi
Communicator

Hi @FinnHatlen 

If the other two values are added to some other field, you could write an eval and use coalesce function to include it in message_text.

https://docs.splunk.com/Documentation/Splunk/8.0.6/SearchReference/ConditionalFunctions#coalesce.28X...

Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...