Visualization solution

[waJesu]

I am new to splunk administration. may someone help with a query that gives both reporting and non-reporting devices in the last 1 hour and be able to show both on a pie-chart

[waJesu]

Thanks Ralph. Would you help with the search query for the reporting devices

[rnowitzki]

Hi @waJesu ,

well, it really depends on your data. 

But to give you an example.

index=<yourindex>  earliest=-24h latest=now 
| stats count  by device | eval day="yes"
| appendcols  [search index=<yourindex>  earliest=-1h latest=now 
| stats count  by device| eval hour="yes"]
| eval status=if(hour="yes","Up","Missing")
| fields - hour, day, count
| stats count by status

This will give you the pure count of "missing" and "up" devices based on a 24h vs 1h compare. In the visualization tab you would select pie chart and your done.

You have to set the index to match your data and also you probably have to change "device" to whatever field your "device" name is stored in. Maybe "host"?

If you remove the last line, you see which devices are missing/up.

Hope it gives you an idea.
BR
Ralph

[waJesu]

Hey Brian. I am not sure why it's returning  Error in "eval" command: The expression is malformed. Expected

[rnowitzki]

Not Brian here, but anyways 🙂

Can you copy&paste your SPL and the whole error message? The only 2 evals in my example are pretty straight forward, not sure what could have gone wrong.

BR
Ralph aka Brian

[rnowitzki]

Hi @waJesu ,

You would need some base to start from. Splunk doesn't really know what's not there.
There are different approaches for this. I'll give you two:

1. Compare the devices that reported in the last 24h with the ones that reported in the last 1h
2. Maintain a Lookup table with all the devices that should report and compare this with the ones that reported in the last 1h.

To help you with the SPL, it would be helpful to see some example data. What kind of devices are in the logs, how do you determine that they are reporting? Do you look for any kind of log from each host(?) or do you expect some specific logline? 

BR
Ralph