I'm after some help on how to set up an adhoc search which displays to an ITSI Glass-table...
We've developed a number of dashboards which show the status of jobs, how many times they've run this period (normally each day) and what time they started and finished. This works great for jobs that are running daily.
We have 1 specific job that only runs if a file is present - typically that's only once or twice month. I want to use an adhoc search which shows us the date/time that it was last run - for a time window of the previous 31 days. This works great if the job has run in the past 2 days, but the Glass-table editor doesn't allow me to change the "earliest time" to anything other more than "2 days ago" - meaning that the dashboard displays a N/A.
If I manually run the search I get an option to extend the time-frame to the last 1 month, and the search works fine (today is 12th March, the job last ran on 09th March - which the manual search shows).
Is there a way of changing the "earliest time" on the Glass-Table to a longer time-frame that 2 days so we can display this info?
This is the search we are using (works fine manually):
index=mail" " "started"
| stats latest(_time) as _time
| eval last_processed_at="Last Run:" .
strftime(_time, "%d/%m/%y, %H:%M")
| table last_processed_at
This is the option that is presented on Glass-table editor:
... View more
Thanks for the response - I think I follow (I've only had limited exposure to SPLUNK so far). So, you are saying that the overall Service Health score in my example will only take into account the GREEN "Normal" statuses of the 3 services beneath it, which is why it displays a score of 100, even though one of the others is less that 100 (but is still NORMAL)..?
In our particular use-case, I don't want either the "Application Server" Health score or the "IT Service Health" score to be anything other than green - because there is only 1 KPI in a warning status and we are trying to represent user experience at the top level (i.e. our Service isn't overly affected by the fact that we have a warning on the amount of free space). I'd like our IT Service Health to remain in normal range but to have a composite score of less than 100 so that it reflects the fact that we have a warning beneath it.
I can (kind of) get it to do something like that, but ONLY if I add the specific KPI for %FREE SPACE in - as you can see in the screenshots below for it..
Doing that skews the top level score and the same would be true if we added ALL of the lowest level KPIS in (as, for example, DB Health has more KPIs than Application Health). We wanted the score at the top level to be aggregate of the 3 different health scores beneath .
Perhaps we are trying to do achieve that the wrong way, so are there suggestions out there on a different method to get the result we require?.
This config. gives us something like the result we want (but not the appopriate overall health score):
(The overall score is too low because it is overly influenced by the single KPI of Application Server %Free space. If it was working as we want the score would be 97.91 - which is the average of the 3 beneath it: 100+100+93.75 /3 )
... View more
We are having some issues in getting our overall Service Health scores to behave as expected and wondered if anyone has encountered similar or has any advice. The image below included to illustrate:
We are using ITSI glass tables to present a basic view of IT Service. This particular table shows an IT Service which presents an overall Health score based on database service (left), HyperVisor (middle) and Application (right). Those components are in turn made up of lower level KPIs (CPU usage, application health, Database response times etc).
In the example below, the application health is affected by an AMBER alert on Free Space - so the health score for App Service is 96.25 - all good there. However, OVERALL service health continues to show 100 even- though we have given Database, HyperVisor, and Application health the same Importance. Simple logic would expect our overall Health to be somewhere around 98.75% ( e.g.
(100+100+96.25) / 3= 98.753) - but it stays at 100. We have tried playing around with the importance and simulated severity settings but those don't seem to make a difference. The only way I can get the overall IT Service Health score to change in this example is to add the "Application server free space KPI" as a direct dependent KPI - but that's not what we want to do.
... View more
ME TOO - did you get any further on this, or find a way of stopping the messages?
We see the same thing as well - and (as you said in the your response) it definitely does not just happen if view zooms have changed. It seems slightly random behaviour on our Glass Tables, as I have found some use-cases where it consistently DOESN'T generate the message to move from one table to another, whilst others consistently DO (even if we just click on the link without doing anything first). I'm wondering if it's something to do with custom v. default drill-downs (I've not tested that yet) which causes them to appear :- wanted to see if you or others had any further info before we invest any more time in it..
... View more
We are in the process of implementing Glass Table views of a number of business processes which will be used by Business Users. Some of the processes are relatively complex - so we have to zoom the glass view out to 90% - or use the Pan option to center the view - to render on a single screen. Even if we then save that as a change, when any user then accesses the Glass Table again, it reverts back to the original position and/or zoom.
Is there any way to make a zoom or position change to a Glass Table then can then be locked and presented to all users? We're trying to avoid the need to resize or re-position each shape in the Glass Tables that we've spent several months developing..
Any help or tips appreciated.
... View more