Splunk Search

want to add extra details to the number display

Ashish0405
Path Finder

Would anyone be able to help me on one more thing please !!! 

I have a Number display dashboard which represent the BGP flap details as # Device_name & #BGP peer IP , however I cannot add the timing when the BGP flap on Number display

Current Query : index="network" %BGP-5 *clip* | rex field=_raw "^(?:[^ \n]* ){4}(?P<Device_name>[^:]+)" | dedup Device_name,src_ip | stats count by Device_name,src_ip,state_to | eval primarycolor=case(state_to="Down", "#D93F3C", state_to="Up", "#31A35F") | eval secondarycolor=primarycolor

Ashish0405_0-1734421057901.png

 

 

Is there something we can add to display flap time in the same number display

 

Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Ashish0405 ,

at first you don't need dedup before stats:

index="network" %BGP-5 *clip* 
| rex field=_raw "^(?:[^ \n]* ){4}(?P<Device_name>[^:]+)" 
| stats count by Device_name src_ip state_to 
| eval 
     primarycolor=case(state_to="Down", "#D93F3C", state_to="Up", "#31A35F"),
     secondarycolor=primarycolor

then, what do you mean with flat time? if the time borders of your search, you can use addinfo command (https://docs.splunk.com/Documentation/Splunk/9.4.0/SearchReference/Addinfo) that with the info_min_time and info_max_time fields gives you the time borders of your search.

index="network" %BGP-5 *clip* 
| rex field=_raw "^(?:[^ \n]* ){4}(?P<Device_name>[^:]+)" 
| stats count by Device_name src_ip state_to 
| eval 
     primarycolor=case(state_to="Down", "#D93F3C", state_to="Up", "#31A35F"),
     secondarycolor=primarycolor
| addinfo
| table Device_name src_ip state_to count primarycolor secondarycolor info_min_time info_max_time

Ciao.

Giuseppe

0 Karma

Ashish0405
Path Finder

Flap time = when one of the peer or you can consider the cable connected to device went down

 

If you see below dashboard we can see the device IP + Flap time , In the other dashboard you can see the Device_name + Device IP, I just want to see all 3 details ( Device name, Device IP & Flap time) in one dashboard,

 

Does it answered your query ? 

Ashish0405_0-1734422730663.png

 

0 Karma

Ashish0405
Path Finder

below image should give some clarity,  Currently I have 2 different dashboard and I want single dashboard with all 3 details.

Ashish0405_0-1734423117726.png

 

0 Karma

Ashish0405
Path Finder

can anyone help me on it please

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval Device=Device_name.":".src_ip
| table Device state_to count primarycolor secondarycolor info_min_time info_max_time

Ashish0405
Path Finder

Thank you so much, the eval command is magical !!!

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...