Reporting

Can you help me create a report based on the following attributes?

viji261992
Explorer

Please help me to create a report with Devicename, corresponding error message and alert count.
We have more than 15,000 devices and the error message would be around 300, I need a report to be generated automatically every week.

0 Karma

VatsalJagani
Motivator

@viji261992,
Try below queries:

index=index-name-here eventuei=* | stats count as "No of alerts" by hostname, eventuei

And

index=index-name-here eventuei=* | stats count as "No of alerts" by hostname

Hope this helps!!!

0 Karma

viji261992
Explorer

I tried the query
index=opennms sourcetype=events eventuei=* | stats count as "No of alerts" by hostname, eventuei

but i am not getting any results

0 Karma

VatsalJagani
Motivator

looks like hostname is not being extracted from your events, can you please verify and check which field do you want instead of hostname?

0 Karma

VatsalJagani
Motivator

We would be glad to help you @viji261992, but can you please provide sample data so we can help you create the report.

0 Karma

viji261992
Explorer

Our splunk is receiving events from network devices, which contains hostname, eventuei="error reason", eventtime.
1. I need to create a report which display the hostname, corresponding error reason , eventtime and no. of alerts generated
2. I need to create a dashboard with device name in the x-axis no. of alerts in the y-axis
3. A complete dashboard which shows total no. of hosts in my company, no. of hosts working fine, no. of hosts are down based on error reason

0 Karma

VatsalJagani
Motivator

For first two try query from my answer, for third I don't know how do you consider your host is working or not? What kind of messages are coming into your dat which can decide host is working? Do you have fix list of host?

0 Karma

viji261992
Explorer

Yes we have a list of hosts available in a .csv file in the same file
'error message types" are provided. Based on the error message we decide whether the host is working or not.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!