Splunk Search

server status on dashboard

sphiwee
Contributor

Good day everyone

 

How can I visualize and edit this query to show the status of our servers, ONLINE/OFFLINE ?

 

sphiwee_0-1599039265647.png

 

Labels (7)
Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sphiwee,

you can see in Dashboard Examples (https://splunkbase.splunk.com/app/1603/) in the "Table Icon Set (Rangemap)" dashboard how to display status using an icon instead a value.

In few words, you have to add to your app a css and a js (that you can find in Dashboard Examples) called by the dashboard

 

<form script="table_icons_rangemap.js" stylesheet="table_decorations.css">

 

then you have to assign an id at your table:

 

 <table id="table1">

 

At the end, you have to add to your search the rangemap command, something like this:

 

index=intau_workfusion host=*
| stats dc(ClusStatus) AS statuses BY host
| rangemap field=statuses severe=0-1 low=2-1000000000 default=severe
| table host range

 

In this way if statuses=0 or 1 you have a red icon and statuses>1 you have a green icon.

if you want to change the name of the range column, you have to modify also the table_icons_rangemap.js file.

Remember to restart Splunk after you added css and js to the app and reload the page at every change in the dashboard otherwise you don't see the icons.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

New This Month - Splunk Observability updates and improvements for faster ...

What’s New? This month, we’re delivering several enhancements across Splunk Observability Cloud for faster and ...

What's New in Splunk Cloud Platform 9.3.2411?

Hey Splunky People! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2411. This release ...

Buttercup Games: Further Dashboarding Techniques (Part 6)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...