Splunk Search

Need your help to create the dashboard for the below request

mputtam
Path Finder

Hi community,

Good Day...!

Need your help to create dashboard for all the notables which are all in the in-progress and pending status along with the assignee names. I was using the below quire but couldn't able to get the correct details please help me out the correct one.

| `es_notable_events` | search timeDiff_type=current | stats sum(count) as count by urgency | `stats2chart("urgency")`

Thanks in Advance,
Kishore.

Labels (5)
0 Karma
1 Solution

alonsocaio
Contributor

Hi @mputtam,

I have created a query based on the `es_notable_events`, following your initial idea.

| `es_notable_events` 
| search timeDiff_type=current AND (status=2 OR status=3)
| table _time, owner, status, status_group, event_id, rule_title

I guess that the query above is a good start and can help you out. In my case, status 2 and 3 are "In Progress" and "Pending". 

View solution in original post

0 Karma

mputtam
Path Finder

Hi alonsocaio,

Thank you very much for your help to getting this issue resolved.

Regards,

Kishore

0 Karma

alonsocaio
Contributor

Hi @mputtam,

I have created a query based on the `es_notable_events`, following your initial idea.

| `es_notable_events` 
| search timeDiff_type=current AND (status=2 OR status=3)
| table _time, owner, status, status_group, event_id, rule_title

I guess that the query above is a good start and can help you out. In my case, status 2 and 3 are "In Progress" and "Pending". 

0 Karma

mputtam
Path Finder

Hi alonsocaio,

Thanks for prompting on this...!

I have checked the query which you had given for the past 24 hours. but there was a difference in the notable count which was presence in the incident review and the query results. and also need all the status names in the results not with the numeric's. 

Tell me if any other ways as well...

| `es_notable_events` | search timeDiff_type=current AND (status=2 OR status=3) | table _time, owner, status, status_group, event_id, rule_title

0 Karma

alonsocaio
Contributor

I have made some changes to the query, maybe this new one can help you.

`notable` 
| search status=2 OR status=3 
| join event_id 
    [| inputlookup es_notable_events 
    | table event_id, rule_title ] 
| table _time, event_id, rule_title, status_label, owner, comment

 

mputtam
Path Finder

Hi alonsocaio,

Thanks you very much to getting this resolved🙂.

I want to change the colors for the bar chart could you please help me on this..? as it was taking default colors there is no option in UI to select the other colors. Please help me out on this.

Have a look into the attached file for your reference.DashboardDashboard

Thanks in advance,
Kishore.

 

0 Karma

alonsocaio
Contributor

Hi,

You can try adding "charting.seriesColors" option into your chart.

<option name="charting.seriesColors">[0x6232a8,0xa8325b,0x329ea8]</option>

 Into the series your syntax should be something like 0xCOLOR_HEX_CODE.

Your dashboard XML should look like:

<dashboard>
  <label>My Dashboard</label>
  <row>
    <panel>
      <chart>
        <title>My Chart</title>
        <search>
          <query>index=MY_INDEX | top 3 host</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        <option name="charting.seriesColors">[0x6232a8,0xa8325b,0x329ea8]</option>
      </chart>
    </panel>
  </row>
</dashboard>
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...