Splunk Search

How to display Event_Status change?

priyankamundarg
Explorer

In a log file I have one field with name EVENT_STATUS. It has 3 values 1.Accepted 2. Pending 3. Rejected
I have designed a dashboard to track the Status of Customer ID.(Initially it will be Pending. once administration approves it then its changed to Accepted)
I would like to display those customer ID which are in Pending status. Once the pending state is changed to Accepted it should go away from the Panel.

index=* source=* EVENT_STATUS="*" Cust_ID | where EVENT_STATUS="PENDING" OR EVENT_STATUS="REJECTED"|search latest(EVENT_STATUS)| table Cust_ID , Cust_NAME ,EVENT_STATUS , EVENT_TIME.

Please specify the correct query.

Tags (4)
0 Karma
1 Solution

sundareshr
Legend

Try this. This allows for cases where EVENT_STATUS can go from Rejected to Pending

index=xyz source=abc EVENT_STATUS=*  Cust_ID=* | stats latest(EVENT_STATUS) as Status by Cust_ID | where Status="Pending"

Use the refresh attribute on the dashboard to set how frequently, in seconds, to refresh the dashboard.
For example, sets the refresh rate to 5 minutes.

https://answers.splunk.com/answers/102621/automatically-refresh-dashboard.html

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you're only interested in Pending customers, this should do it.

index=foo EVENT_STATUS="Pending" | dedup EVENT_STATUS, Cust_ID | table Cust_ID , Cust_NAME ,EVENT_STATUS , EVENT_TIME
---
If this reply helps you, Karma would be appreciated.
0 Karma

priyankamundarg
Explorer

I tried this way. When status is changed from PENDING to ACCEPTED the cust id still remains in the panel. It will not vanish.

0 Karma

sundareshr
Legend

Try this. This allows for cases where EVENT_STATUS can go from Rejected to Pending

index=xyz source=abc EVENT_STATUS=*  Cust_ID=* | stats latest(EVENT_STATUS) as Status by Cust_ID | where Status="Pending"

Use the refresh attribute on the dashboard to set how frequently, in seconds, to refresh the dashboard.
For example, sets the refresh rate to 5 minutes.

https://answers.splunk.com/answers/102621/automatically-refresh-dashboard.html

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...