Splunk Search

Static field value

bsaujla131984
Path Finder

I have created a dashboard to show windows server uptime.

Now I would like to add application name of all servers. For example, Application A is hosted on Server A and Application B is hosted on Server B. I want to show these application in the dashboard corresponding their respective server names.

index = Index host=ServerA OR host=ServerB OR host=ServerC OR host=ServerD OR host=ServerE | eval Uptime_Days = System_Up_Time/86400 | chart max(Uptime_Days) as "System Uptime in Days" by host | sort -Uptime_Days

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

A lookup table should do the job. Create a CSV file with an "Application" column and a "Server" column. Then reference the lookup in your query.

index = Index host=ServerA OR host=ServerB OR host=ServerC OR host=ServerD OR host=ServerE 
| eval Uptime_Days = System_Up_Time/86400 
| chart max(Uptime_Days) as "System Uptime in Days" by host 
| sort -Uptime_Days 
| lookup servers.csv Server as host OUTPUT Application 
| table host Application Uptime_Days
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

rmmiller
Contributor

I think this is best achieved with a lookup.

This thread should get you pointed in the right direction:
https://answers.splunk.com/answers/659192/how-to-use-a-lookup-table-in-a-splunk-query.html

Hope that helps!
rmmiller

0 Karma

richgalloway
SplunkTrust
SplunkTrust

A lookup table should do the job. Create a CSV file with an "Application" column and a "Server" column. Then reference the lookup in your query.

index = Index host=ServerA OR host=ServerB OR host=ServerC OR host=ServerD OR host=ServerE 
| eval Uptime_Days = System_Up_Time/86400 
| chart max(Uptime_Days) as "System Uptime in Days" by host 
| sort -Uptime_Days 
| lookup servers.csv Server as host OUTPUT Application 
| table host Application Uptime_Days
---
If this reply helps you, Karma would be appreciated.
0 Karma

bsaujla131984
Path Finder

I tried as suggested, but not getting any server up time now.

0 Karma

bsaujla131984
Path Finder

Thanks Rich, it worked by just tweaking a bit as below :-

index = Index host=ServerA OR host=ServerB OR host=ServerC OR host=ServerD OR host=ServerE
| lookup servers.csv Server as host OUTPUT Application
| eval Uptime_Days = System_Up_Time/86400
| stats max(Uptime_Days) as "System Uptime in Days" by host Application

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...