Monitoring Splunk

How to find the application is running ?


Hi Team 

Can someone help me to create a dashboard panel which will highlight an alert when the 
Incoming > 0 and Outgoing = 0 in last 30 mins. 

Requirement is to highlight an alert in the dashboard when the processing is not done in last 30 mins. 

Query to find the incoming (IN_per_24h) and outgoing (OUT_per_24h) is fetched using the below query: 
|tstats count(PREFIX(nidf=)) as t where index=events_prod_cdp_penalty_esa source="SYSLOG"

by _time PREFIX(nidf=) span=5m
| rename nidf= as NIDF | eval NIDF=UPPER(NIDF)
| eval DIR = if(NIDF="RPWARDA" ,"IN","OUT")
| timechart span=5m sum(t) by DIR
| eval DAT_rel = relative_time(_time, "+3h")
| eval day_of_week=lower(strftime(DAT_rel, "%a"))
| eval DAT_rel = if(day_of_week = "sun", relative_time(DAT_rel, "+1d"),DAT_rel)
| eval DAT_rel = if(day_of_week = "sat", relative_time(DAT_rel, "+2d"),DAT_rel)
| eval DAT = strftime(DAT_rel, "%Y/%m/%d") 
| streamstats sum(*) as *_per_24h by DAT reset_on_change=true
| eval backlog = (IN_per_24h - OUT_per_24h )
| table _time IN_per_24h OUT_per_24h backlog

Labels (1)
0 Karma



Is it possible to use any graph/visualization to show that in last 30 mins 
INCOMING is greater than 0 and OUTGOING = 0 . 



0 Karma


Technically, yes it is possible (probably), but it is not simple. Visualisations work on series i.e. all points / bars from the same series are shown in the same colour, so what you could do is duplicate the incoming series and in one copy of the series set the value to zero if the out going count is create than zero and in the other series set the value to zero if the outgoing count is zero.

Using random generated values, this demonstrates what I mean

| gentimes start=-1 increment=1h
| rename starttime as _time 
| fields _time
| eval incoming=random()%10
| eval outgoing=random()%10
| eval unprocessed = if(outgoing > 0, 0, incoming)
| eval incoming = if(outgoing > 0, incoming, 0)



0 Karma


Given that you already have 5 minute counts, do you want a rolling 30 minutes i.e. 6 event window? If so, you could use something like this:

| streamstats sum(*) as *_last_30mins window=6


0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...