Dashboards & Visualizations

How to create a search for the dashboard to show last event from each source?

ng87
Path Finder

We have an index that reads in log files from disk. Each logfile is its own source under the index, I want to create a basic health dashboard that shows the source name and when the last event/log was received and in the perfect world turn red if the last log was received more than x hours ago.

I currently have this set up with a single dashboard for each source, however, I would like to try and consolidate into a single dashboard.

Any help would be amazing

0 Karma
1 Solution

adonio
Ultra Champion

maybe a single panel will do,
try out this search:

| tstats max(_time) as last_event where index=* by source
| eval last_event_human = strftime(last_event, "%c")
| eval now = now()
| eval diff_in_seconds = now - last_event
| eval alert = if(diff_in_seconds>10,"alert","OK")

change the index=* to your index
feel free to change the alert value (here 10 seconds) to your desired value

hope it helps

View solution in original post

adonio
Ultra Champion

maybe a single panel will do,
try out this search:

| tstats max(_time) as last_event where index=* by source
| eval last_event_human = strftime(last_event, "%c")
| eval now = now()
| eval diff_in_seconds = now - last_event
| eval alert = if(diff_in_seconds>10,"alert","OK")

change the index=* to your index
feel free to change the alert value (here 10 seconds) to your desired value

hope it helps

Get Updates on the Splunk Community!

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...