Reporting

Can you help me create a report based on the following attributes?

viji261992
Explorer

Please help me to create a report with Devicename, corresponding error message and alert count.
We have more than 15,000 devices and the error message would be around 300, I need a report to be generated automatically every week.

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@viji261992,
Try below queries:

index=index-name-here eventuei=* | stats count as "No of alerts" by hostname, eventuei

And

index=index-name-here eventuei=* | stats count as "No of alerts" by hostname

Hope this helps!!!

0 Karma

viji261992
Explorer

I tried the query
index=opennms sourcetype=events eventuei=* | stats count as "No of alerts" by hostname, eventuei

but i am not getting any results

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

looks like hostname is not being extracted from your events, can you please verify and check which field do you want instead of hostname?

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

We would be glad to help you @viji261992, but can you please provide sample data so we can help you create the report.

0 Karma

viji261992
Explorer

Our splunk is receiving events from network devices, which contains hostname, eventuei="error reason", eventtime.
1. I need to create a report which display the hostname, corresponding error reason , eventtime and no. of alerts generated
2. I need to create a dashboard with device name in the x-axis no. of alerts in the y-axis
3. A complete dashboard which shows total no. of hosts in my company, no. of hosts working fine, no. of hosts are down based on error reason

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

For first two try query from my answer, for third I don't know how do you consider your host is working or not? What kind of messages are coming into your dat which can decide host is working? Do you have fix list of host?

0 Karma

viji261992
Explorer

Yes we have a list of hosts available in a .csv file in the same file
'error message types" are provided. Based on the error message we decide whether the host is working or not.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...