Splunk Search

How to build a dashboard to show critical devices without any overlapping


Hello Everyone,
I'm trying to build a dashboard to show all my critical devices that do not report to Splunk for a certain period of time. But my dashboard shows some devices overlapping a couple of times. For example, some devices show multiple times on different time-frame. I was wondering how can I show each device once and for a specific time frame without any overlap.
Any help would be really appreciated.


Tags (3)
0 Karma

Esteemed Legend

You can reduce you time-frames to the boundary edges by using | bin _time span=1d (the 1d is for 1 day) and then you can use | depdup 1 _time plus other fields here to keep only 1.

0 Karma

Esteemed Legend

HI louispaul76,
I'm not sure to have understand your question,
anyway, the way to proceed is to create a lookup (called e.g. perimeter.csv) containing the hostnames of your critical devices (the column is called hostname), then run a search like this:

| metasearch index=_internal
| eval host=upper(host)
| stats count BY host
| append [ | inputlookup perimeter.csv | eval host=upper(hostname), count=0 | fields host, count ]
| stats sum(count) AS Total BY host
| where Total=0

In this way you have the list of all devices that didn't send logs in a period.
I used _internal because in this way I'm sure that Splunk is always receiving logs, so, when there aren't, there's a problem!
To use this search also for devices without Forwarder, you have to be sure that the devices always send logs, so, when there aren't, it's an anomaly!
In this way, replace the main search with another one (e.g. index=my_index).

Now you can create an alert or a dashboard,

If you want a dashboard that display the status of all devices, you can delete the last row, so the hosts with "0" are missing and the others are present.
You can display the status also in graphic mode, highlighting the status with a flag.



Not clear on what you are asking. Can you brief with a small example/anonymized data/code

<your base search> | sort - _time| dedup device | blah blah
0 Karma
Get Updates on the Splunk Community!

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...