How to display Event_Status change?

[priyankamundarg]

In a log file I have one field with name EVENT_STATUS. It has 3 values 1.Accepted 2. Pending 3. Rejected
I have designed a dashboard to track the Status of Customer ID.(Initially it will be Pending. once administration approves it then its changed to Accepted)
I would like to display those customer ID which are in Pending status. Once the pending state is changed to Accepted it should go away from the Panel.

index=* source=* EVENT_STATUS="*" Cust_ID | where EVENT_STATUS="PENDING" OR EVENT_STATUS="REJECTED"|search latest(EVENT_STATUS)| table Cust_ID , Cust_NAME ,EVENT_STATUS , EVENT_TIME.

Please specify the correct query.

[richgalloway]

If you're only interested in Pending customers, this should do it.

index=foo EVENT_STATUS="Pending" | dedup EVENT_STATUS, Cust_ID | table Cust_ID , Cust_NAME ,EVENT_STATUS , EVENT_TIME

[priyankamundarg]

I tried this way. When status is changed from PENDING to ACCEPTED the cust id still remains in the panel. It will not vanish.

[sundareshr · Accepted solution]

Try this. This allows for cases where EVENT_STATUS can go from Rejected to Pending

index=xyz source=abc EVENT_STATUS=*  Cust_ID=* | stats latest(EVENT_STATUS) as Status by Cust_ID | where Status="Pending"

Use the refresh attribute on the dashboard to set how frequently, in seconds, to refresh the dashboard.
For example, sets the refresh rate to 5 minutes.

https://answers.splunk.com/answers/102621/automatically-refresh-dashboard.html