How to build a dashboard to show critical devices without any overlapping

[louispaul76]

Hello Everyone,
I'm trying to build a dashboard to show all my critical devices that do not report to Splunk for a certain period of time. But my dashboard shows some devices overlapping a couple of times. For example, some devices show multiple times on different time-frame. I was wondering how can I show each device once and for a specific time frame without any overlap.
Any help would be really appreciated.

Lance

[woodcock]

You can reduce you time-frames to the boundary edges by using | bin _time span=1d (the 1d is for 1 day) and then you can use | depdup 1 _time plus other fields here to keep only 1.

[gcusello]

HI louispaul76,
I'm not sure to have understand your question,
anyway, the way to proceed is to create a lookup (called e.g. perimeter.csv) containing the hostnames of your critical devices (the column is called hostname), then run a search like this:

| metasearch index=_internal
| eval host=upper(host)
| stats count BY host
| append [ | inputlookup perimeter.csv | eval host=upper(hostname), count=0 | fields host, count ]
| stats sum(count) AS Total BY host
| where Total=0

In this way you have the list of all devices that didn't send logs in a period.
I used _internal because in this way I'm sure that Splunk is always receiving logs, so, when there aren't, there's a problem!
To use this search also for devices without Forwarder, you have to be sure that the devices always send logs, so, when there aren't, it's an anomaly!
In this way, replace the main search with another one (e.g. index=my_index).

Now you can create an alert or a dashboard,

If you want a dashboard that display the status of all devices, you can delete the last row, so the hosts with "0" are missing and the others are present.
You can display the status also in graphic mode, highlighting the status with a flag.

Bye.
Giuseppe

[nareshinsvu]

Not clear on what you are asking. Can you brief with a small example/anonymized data/code

<your base search> | sort - _time| dedup device | blah blah