Splunk Search

How to build a dashboard to show critical devices without any overlapping


Hello Everyone,
I'm trying to build a dashboard to show all my critical devices that do not report to Splunk for a certain period of time. But my dashboard shows some devices overlapping a couple of times. For example, some devices show multiple times on different time-frame. I was wondering how can I show each device once and for a specific time frame without any overlap.
Any help would be really appreciated.


Tags (3)
0 Karma

Esteemed Legend

You can reduce you time-frames to the boundary edges by using | bin _time span=1d (the 1d is for 1 day) and then you can use | depdup 1 _time plus other fields here to keep only 1.

0 Karma

Esteemed Legend

HI louispaul76,
I'm not sure to have understand your question,
anyway, the way to proceed is to create a lookup (called e.g. perimeter.csv) containing the hostnames of your critical devices (the column is called hostname), then run a search like this:

| metasearch index=_internal
| eval host=upper(host)
| stats count BY host
| append [ | inputlookup perimeter.csv | eval host=upper(hostname), count=0 | fields host, count ]
| stats sum(count) AS Total BY host
| where Total=0

In this way you have the list of all devices that didn't send logs in a period.
I used _internal because in this way I'm sure that Splunk is always receiving logs, so, when there aren't, there's a problem!
To use this search also for devices without Forwarder, you have to be sure that the devices always send logs, so, when there aren't, it's an anomaly!
In this way, replace the main search with another one (e.g. index=my_index).

Now you can create an alert or a dashboard,

If you want a dashboard that display the status of all devices, you can delete the last row, so the hosts with "0" are missing and the others are present.
You can display the status also in graphic mode, highlighting the status with a flag.



Not clear on what you are asking. Can you brief with a small example/anonymized data/code

<your base search> | sort - _time| dedup device | blah blah
0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...