How to create a dashboard for servers with a status Green/Red (Up or Down)

[Uday]

Hi, I got a new requirement to build a dashboard showing server status (Up/Down). Unfortunately our logs does n't indicate any such status like server started or server down. Any suggestions please? Any examples that I can see?

[gcusello]

Hi @Uday,

this is a new question and it's better to create a new one.

Anyway, you can see in Dashboard Examples (https://splunkbase.splunk.com/app/1603/) in the "Table Icon Set (Rangemap)" dashboard how to display status using an icon instead a value.

Is solves adding to your app a css and a js that are called by the dashboard

<form script="table_icons_rangemap.js" stylesheet="table_decorations.css">

then at your table is assigna an id:

 <table id="table1">

Remember to restart Splunk after you added css and js to the app and reload the page at every change in the dashboard otherwise you don't see the icons.

About the problem that you haven't a status field, you can create it using eval or (better) rangemap command, something like this:

e.g. to find hosts (listed in a lookup) that aren't sending logs:

| metasearch index=_internal
| eval host=lower(host)
| stats count BY host
| append [ | inputlookup systems.csv | eval host=lower(host), count=0 | fields host count ]
| stats sum(count) AS total BY host
| rangemap field=total severe=0-0 low=1-1000000000 default=severe

in this way the added javascript takes the value from rangemap and assign an icon.

Ciao.

Giuseppe

[Uday]

Thanks for your reply. Is it possible to provide me the query to search  logs for any data at all from the servers in the last x minutes? I will try this solution.

[richgalloway]

You could create a Python script that probes each server and sends an up/down indication to Splunk.

It may be easier, however, to search your logs for any data at all from the servers in the last x minutes.  If data is present then the server is up; otherwise, consider it down.

[Uday]

Thanks for your reply. Is it possible to provide me the query to search  logs for any data at all from the servers in the last x minutes? I will try this solution.