Hi All,
Good day, I have juniper data in Splunk using sourcetype = juniper*
but need some searches to create dashboards which are useful for juniper team to check if any down or outage
could you please tell me any searches for this juniper dashboard
Hi @sekhar463
Can u try this.
| tstats latest(_time) as latest_time where index=yourindex sourcetpye=juniper* by sourcetype
| append
[| search index=yourindex sourcetype=juniper*
| eval latest_time=relative_time(now(),"-10m")]
| stats max(*) as * by sourcetype
| eval dif = now() - latest_time
| search dif > 600
it will work if there is no log from any sourcetype in the last 10 minutes. You can set the time according to you.
what is this search will give.
if any searches to get juniper interfaces down like juniper routing neighbor down
This search will actually help to detect when there is no log from resource types.(interface down or any problem in logging etc.) If this is not exactly what you want, can you specify your request in more detail?