In a log file I have one field with name EVENT_STATUS. It has 3 values 1.Accepted 2. Pending 3. Rejected
I have designed a dashboard to track the Status of Customer ID.(Initially it will be Pending. once administration approves it then its changed to Accepted)
I would like to display those customer ID which are in Pending status. Once the pending state is changed to Accepted it should go away from the Panel.
index=* source=* EVENT_STATUS="*" Cust_ID | where EVENT_STATUS="PENDING" OR EVENT_STATUS="REJECTED"|search latest(EVENT_STATUS)| table Cust_ID , Cust_NAME ,EVENT_STATUS , EVENT_TIME.
Please specify the correct query.
Try this. This allows for cases where EVENT_STATUS can go from Rejected to Pending
index=xyz source=abc EVENT_STATUS=* Cust_ID=* | stats latest(EVENT_STATUS) as Status by Cust_ID | where Status="Pending"
Use the refresh attribute on the dashboard to set how frequently, in seconds, to refresh the dashboard.
For example, sets the refresh rate to 5 minutes.
https://answers.splunk.com/answers/102621/automatically-refresh-dashboard.html
If you're only interested in Pending customers, this should do it.
index=foo EVENT_STATUS="Pending" | dedup EVENT_STATUS, Cust_ID | table Cust_ID , Cust_NAME ,EVENT_STATUS , EVENT_TIME
I tried this way. When status is changed from PENDING to ACCEPTED the cust id still remains in the panel. It will not vanish.
Try this. This allows for cases where EVENT_STATUS can go from Rejected to Pending
index=xyz source=abc EVENT_STATUS=* Cust_ID=* | stats latest(EVENT_STATUS) as Status by Cust_ID | where Status="Pending"
Use the refresh attribute on the dashboard to set how frequently, in seconds, to refresh the dashboard.
For example, sets the refresh rate to 5 minutes.
https://answers.splunk.com/answers/102621/automatically-refresh-dashboard.html