Help creating a dashboard

[jaywv6299]

I have vmware view data going into splunk and i currently send alerts to an email group if a pooled image (TotalVMs>1) has less then 3 vms available (availableVMs is <3).

However, i would like to create a dashboard for this to be displayed as well. Showing a pie chart of TotalVMs/availablevms/busyvms/poweredoffvms.

All of this information is in one line in splunk, however I have about 20-30 pools (working on consolidation) and would like the dashboard to show all of the pools and a pie chart for each with the status mentioned above. Here are 3 lines extract from my log upload from vmware view broker. Any help or direction would be greatly appreciated.

2014-03-21T07:39:28.585-05:00 DEBUG (0A38-115C) [VirtualCenterDriver] Determine actions for cn=image1,ou=server groups,dc=vdi,dc=vmware,dc=int: totalVMs=70, availableVMs=7, zombieVMs=0, busyVMs=56, poweredOffVMs=7, suspendedVMs=0, vmMaximumCount=70, vmMinimumCount=70, vmHeadroomCount=8, customizingVMs=0, errorVMs=0, recentlyRecoveredVMs=0
host=Viewbroker Options| sourcetype=vmware-view Options| source=C:\ProgramData\VMware\VDM\logs\debug-2014-03-21-071859.txt Options| availableVMs=7 Options| totalVMs=70 Options

2014-03-21T07:39:28.584-05:00 DEBUG (0A38-115C) [VirtualCenterDriver] Determine actions for cn=image2,ou=server groups,dc=vdi,dc=vmware,dc=int: totalVMs=17, availableVMs=7, zombieVMs=0, busyVMs=10, poweredOffVMs=0, suspendedVMs=0, vmMaximumCount=17, vmMinimumCount=17, vmHeadroomCount=12, customizingVMs=0, errorVMs=0, recentlyRecoveredVMs=0
host=Viewbroker Options| sourcetype=vmware-view Options| source=C:\ProgramData\VMware\VDM\logs\debug-2014-03-21-071859.txt Options| availableVMs=7 Options| totalVMs=17 Options

2014-03-21T07:39:28.583-05:00 DEBUG (0A38-115C) [VirtualCenterDriver] Determine actions for cn=image3,ou=server groups,dc=vdi,dc=vmware,dc=int: totalVMs=10, availableVMs=5, zombieVMs=0, busyVMs=1, poweredOffVMs=4, suspendedVMs=0, vmMaximumCount=10, vmMinimumCount=10, vmHeadroomCount=5, customizingVMs=0, errorVMs=0, recentlyRecoveredVMs=0
host=Viewbroker Options| sourcetype=vmware-view Options| source=C:\ProgramData\VMware\VDM\logs\debug-2014-03-21-071859.txt Options| availableVMs=5 Options| totalVMs=10 Options

[somesoni2 · Accepted solution]

Simplest options will be to run the searches your have and save it as dashboard panel.

sample search (Table)

your base search | stats first(totalVMs) as totalVMs, first(availableVMs) as availableVMs , first(poweredOffVMs) as poweredOffVMs  first(busyVMs) as busyVMs by cn | rename cn as poolName

Piechart: (change the field name in stats to generate pie chart for other fields)

your base search | stats first(totalVMs) as totalVMs by cn | rename cn as poolName

[jaywv6299]

Great, i was able to use that information to finalize what I wanted. Not exactly how I wanted it to appear, but it is a good start.