Device online status dashboard

[TTAL]

Hello everyone,

New and trying to learn, I've searched for hours trying to get a dashboard to display computers within my domain and if they are online or not with a time associated. the time associated with being up or down isn't important, just a nicety. 

[gcusello]

Hi @TTAL ,

to have a status dashboard, you need at first a list of the systems to monitor.

You can put this list in a lookup (called e.g. perimeter.csv) containing at least one field (host).

Then you can run a search like the following:

| tstats count WHERE index=* BY host
| append [ | inputlookup perimeter.csv | eval count=0 | fields host count ]
| stats sum(count) AS total BY host
| eval status=if(total=0,"Missing","Present")
| table host status

then you could also consider the case that you have some host not present in the lookup, in this case, you have to use a little more complicated search:

| tstats count WHERE index=* BY host
| eval tyte="index"
| append [ | inputlookup perimeter.csv | eval count=0, type="lookup" | fields host count type ]
| stats 
     dc(type) AS type_count 
     values(type) AS type 
     sum(count) AS total BY host
| eval status=case(total=0,"Missing",type_count=1 AND type="index","new host",true(),"Present")
| table host status

At least , if you don't want to manage the list of hosts to monitor, you can use a different search to find the hosts that sent logs in the last 7 days but that didn't send logs in tha last hour (obviuously you can change these parameters:

| tstats count latest(_time) AS _time WHERE index=* latest=-30d@d BY host
| eval status=if(_time<now()-3600,"Missing","Present")
| table host status

I don't like this last solution because, even if requires more time to manage but it gives you less control than the others.

 Ciao.

Giuseppe

[marnall]

What sort of logs do you have from your computers? Ideally you can identify a log that is only produced when the computer is online, then you could search for that log using a time selector, and it would show which computers are online in that time.

[ITWhisperer]

Splunk is go for reporting on what is in the logs, it is not so good at reporting on what is not there, so if a server is offline, there may not be any data in Splunk for that server, so you have to tell Splunk which servers to expect to find data for. This is often done by using a lookup table with the names of the servers and checking the logs against these names to find out when the last piece of information were indexed.