Getting Data In

Create dashboard to show vmware AlarmStatusChangedEvent until event goes from red to green

New Member

I am running index=vmware-taskevent | spath eventClass | search eventClass=AlarmStatusChangedEvent and I want to have my dashboard show only the events that have not changed from red to green.

Here is the raw text:
{"entity": {"entity": {"moid": "host-145895", "type": "HostSystem"}, "name": ""}, "datacenter": {"datacenter": {"moid": "datacenter-21", "type": "Datacenter"}, "name": "Mason"}, "createdTime": "2020-02-05 21:17:48.765000+00:00", "alarm": {"alarm": {"moid": "alarm-1", "type": "Alarm"}, "name": "Host connection and power state"}, "source": {"entity": {"moid": "group-d1", "type": "Folder"}, "name": "Datacenters"}, "eventClass": "AlarmStatusChangedEvent", "chainId": "-1182388515", "host": {"host": {"moid": "host-145895", "type": "HostSystem"}, "name": ""}, "to": "green", "computeResource": {"computeResource": {"moid": "domain-s145893", "type": "ComputeResource"}, "name": ""}, "from": "red", "fullFormattedMessage": "Alarm 'Host connection and power state' on changed from Red to Green", "userName": "None", "key": "-1182388515"}

0 Karma

Ultra Champion


| eval _raw="{\"entity\": {\"entity\": {\"moid\": \"host-145895\", \"type\": \"HostSystem\"}, \"name\": \"\"}, \"datacenter\": {\"datacenter\": {\"moid\": \"datacenter-21\", \"type\": \"Datacenter\"}, \"name\": \"Mason\"}, \"createdTime\": \"2020-02-05 21:17:48.765000+00:00\", \"alarm\": {\"alarm\": {\"moid\": \"alarm-1\", \"type\": \"Alarm\"}, \"name\": \"Host connection and power state\"}, \"source\": {\"entity\": {\"moid\": \"group-d1\", \"type\": \"Folder\"}, \"name\": \"Datacenters\"}, \"eventClass\": \"AlarmStatusChangedEvent\", \"chainId\": \"-1182388515\", \"host\": {\"host\": {\"moid\": \"host-145895\", \"type\": \"HostSystem\"}, \"name\": \"\"}, \"to\": \"green\", \"computeResource\": {\"computeResource\": {\"moid\": \"domain-s145893\", \"type\": \"ComputeResource\"}, \"name\": \"\"}, \"from\": \"red\", \"fullFormattedMessage\": \"Alarm 'Host connection and power state' on changed from Red to Green\", \"userName\": \"None\", \"key\": \"-1182388515\"}"
| spath createdTime
| spath eventClass
| spath from
| spath to
| table createdTime eventClass from to


index=vmware-taskevent "AlarmStatusChangedEvent" NOT "changed from Red to Green"

As you like.

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...