Dashboards & Visualizations

compare relative data in splunk dashboard panels

kranthimutyala
Path Finder

Hi Splunkers,

Im working on Dashboard which has two panels which shows the status of Bots.First panel shows the status of all the bots and second shows the list of unsuccessful bots.My requirement is to show bot in the unsuccessful panel if the latest run of the bot is not successful and if the latest run of the bot is successful then there shouldn't be any entry in the unsuccessful bots panel.Is there any option where we can compare the current status and remove the unsuccessful entries from the below panel. Attached is the screen shot for the reference.Thanks for any help here.

First panel query :  index="abc" (TYPE="Run bot finished" OR TYPE="Run bot Deployed") | $bot$ | $env$ | table _time,BOT_NAME, STATUS

Second Panel query: index="abc" (TYPE="Run bot finished" OR TYPE="Run bot Deployed") STATUS="Unsuccessful" | $bot$ | $env$ | table _time,BOT_NAME,STATUS

 

Screenshot 2021-01-30 at 10.25.25 AM.png

Labels (1)
Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
index="abc" (TYPE="Run bot finished" OR TYPE="Run bot Deployed") | $bot$ | $env$ | stats latest(_time) as _time latest(STATUS) as STATUS by BOT_NAME | where STATUS="Unsuccessful" | table _time,BOT_NAME,STATUS

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index="abc" (TYPE="Run bot finished" OR TYPE="Run bot Deployed") | $bot$ | $env$ | stats latest(_time) as _time latest(STATUS) as STATUS by BOT_NAME | where STATUS="Unsuccessful" | table _time,BOT_NAME,STATUS
0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...