Splunk server status dashboard - code issue

[bbraun]

Hi,

I've done a lot of research and have applied many different "fixes" but none have seemed to work.

I'm trying to build a Splunk server status dashboard that shows either "OK" or "down". The two values that I'm working with are 0 and 1. 0 being OK and 1 being down.

I've tried adding rangemap (|rangemap field=Status low=0-0 severe=1-1 ) which didn't resolve my issue.

Can someone look at my code and determine what I'm doing wrong?

my version is 6.5.2

<dashboard>
  <label>SplunkHealth</label>
  <row>
    <panel>
      <title>Indexer 01</title>
      <single>
        <search>
          <query>|inputlookup all_servers.csv  | eval splunk_server=host  | join type=left   splunk_server [|rest /services/server/info]  | join type=left splunk_server [| rest /services/server/status/resource-usage/hostwide ]|fillnull value="Non-Reporting" | eval   Status=if(updated="Non-Reporting",1,0)  |rename splunk_server AS Server| search role=indexer |search Server=slpsplnkidl01 | table Status | eval Status=case(Status=0, "OK", Status=1, "DOWN")</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0xd93f3c"]</option>
        <option name="rangeValues">[0,1]</option>
        <option name="field">Status</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
  </row>
</dashboard>

[DavidHourani]

Hello bbraun,

You can do this via GUI by simply setting the color range when you click on --> Format Visualization -> color.
No need to edit this via code or anything. Your source should have the options bellow afterwards:

<panel>
  <single>
    <title>your title</title>
    <search>
      <query>your search</query>
      <earliest>$date1.earliest$</earliest>
      <latest>$date1.latest$</latest>
    </search>
    <option name="colorMode">block</option>
    <option name="rangeColors">["0x65a637","0xd93f3c"]</option>
    <option name="rangeValues">[0]</option>
    <option name="useColors">1</option>
  </single>
</panel>

Let me know how that goes for you.

Regards,
David

[gcusello]

Hi bbraun,
I usually use this search to diplay server status (where Perimeter.csv is a lookup containing all the server in my perimeter to monitor):

| metasearch index=_internal earliest=-300s latest=now
| eval host=upper(host) 
| stats count by host 
| append [ 
     | inputlookup Perimeter.csv 
     | eval count=0, host=upper(host)  
     ] 
| stats sum(count) AS Total by host 
| rangemap field=Total severe=0-0 low=1-1000000000 default=severe 
| table host range

I display status in graphic mode, to do this follw indications in "Table Icon Set (Rangemap)" dashboard of "Splunk 6.x Dashboard Examples" App.

Bye.
Giuseppe

[jkat54]

If colors is the issue try this:

 <option name="charting.fieldColors">{"DOWN":0xFF0000,"OK":0x00FF00}</option>

Basically saying if the value of Status is DOWN, red, if it's OK, green.

[bbraun]

When I add that line I receive the below error.

Warning on line 18: Unknown option name="charting.fieldColors" for node="single"

Should if be added to a specific line? Does any need to be removed?

[DavidHourani]

yes charting.fieldColors is for charts and not "single" panels.

[jkat54]

What's the problem?