I'm trying to build a dashboard to show all my critical devices that do not report to Splunk for a certain period of time. But my dashboard shows some devices overlapping a couple of times. For example, some devices show multiple times on different time-frame. I was wondering how can I show each device once and for a specific time frame without any overlap.
Any help would be really appreciated.
I'm not sure to have understand your question,
anyway, the way to proceed is to create a lookup (called e.g. perimeter.csv) containing the hostnames of your critical devices (the column is called hostname), then run a search like this:
| metasearch index=_internal
| eval host=upper(host)
| stats count BY host
| append [ | inputlookup perimeter.csv | eval host=upper(hostname), count=0 | fields host, count ]
| stats sum(count) AS Total BY host
| where Total=0
In this way you have the list of all devices that didn't send logs in a period.
I used _internal because in this way I'm sure that Splunk is always receiving logs, so, when there aren't, there's a problem!
To use this search also for devices without Forwarder, you have to be sure that the devices always send logs, so, when there aren't, it's an anomaly!
In this way, replace the main search with another one (e.g. index=my_index).
Now you can create an alert or a dashboard,
If you want a dashboard that display the status of all devices, you can delete the last row, so the hosts with "0" are missing and the others are present.
You can display the status also in graphic mode, highlighting the status with a flag.