How to create dashboards which are useful for Juniper team to check if any down or outage?

[sekhar463]

Hi All,

Good day, I have juniper data in Splunk using sourcetype = juniper*

but need some searches to create dashboards which are useful for juniper team to check if any down or outage 

could you please tell me any  searches for this juniper dashboard 

[MYilmaz]

Hi @sekhar463  

Can u try this.

| tstats latest(_time) as latest_time where index=yourindex sourcetpye=juniper* by sourcetype 
| append 
    [| search index=yourindex sourcetype=juniper* 
    | eval latest_time=relative_time(now(),"-10m")] 
| stats max(*) as * by sourcetype 
| eval dif = now() - latest_time 
| search dif > 600

it will work if there is no log from any sourcetype in the last 10 minutes. You can set the time according to you.

[sekhar463]

what is this search will give.

if any searches to get juniper interfaces down like juniper routing neighbor down

[MYilmaz]

This search will actually help to detect when there is no log from resource types.(interface down or any problem in logging etc.) If this is not exactly what you want, can you specify your request in more detail?