Splunk Search

How to create dashboards which are useful for Juniper team to check if any down or outage?

sekhar463
Path Finder

Hi All,

Good day, I have juniper data in Splunk using sourcetype = juniper*

but need some searches to create dashboards which are useful for juniper team to check if any down or outage 

could you please tell me any  searches for this juniper dashboard 

Labels (1)
Tags (1)
0 Karma

MYilmaz
Explorer

Hi @sekhar463  

Can u try this.

 

| tstats latest(_time) as latest_time where index=yourindex sourcetpye=juniper* by sourcetype 
| append 
    [| search index=yourindex sourcetype=juniper* 
    | eval latest_time=relative_time(now(),"-10m")] 
| stats max(*) as * by sourcetype 
| eval dif = now() - latest_time 
| search dif > 600

 

 

it will work if there is no log from any sourcetype in the last 10 minutes. You can set the time according to you.

0 Karma

sekhar463
Path Finder

what is this search will give.

if any searches to get juniper interfaces down like juniper routing neighbor down

0 Karma

MYilmaz
Explorer

This search will actually help to detect when there is no log from resource types.(interface down or any problem in logging etc.) If this is not exactly what you want, can you specify your request in more detail?

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...