I am new to Splunk and the SPL in general so I will try and explain as best I can. I have been tasked to produce an UP/DOWN dashboard to show different Microsoft Cloud services and their statuses. We are importing data from the Microsoft Service Health and can run searches on it. I am able to find each service (Microsoft Teams, Exchange Online, SharePoint Online etc) and their current status (up or down).
Now I need to show this in a dashboard but my manager wants to group the services in categories like, Core services, Productivity and Cloud Apps so that if a person navigates tot he dashboard they can click a dropdown and select the category then those services are displayed with their UP/DOWN status.
Any help would be much appreciated.
Ok so I had the following:
index=azure source="ServiceAnnouncement.Issues" | sort 0 - _time | eval category = if(service = "Exchange Online" , "Core Service" , other)
But how can I do multiple if statements?
You probably need to eval a new field which categorises the services and then filter on those categories. You could use a case function or if functions to do the evaluation, or you could define and use a lookup to map the service to its category.