Dashboards & Visualizations

How to display a marker gauge for each host showing the amount of today's logs?

SecureIA
Path Finder

Hi helpful people,

Is there a way of showing a marker gauge for each host in my network that shows the total amount of logs for the current day? I wish to display this on a dashboard so that we can easily determine whether a machine is outputting an abnormal amount of logs.

Any help would be truly appreciated.

0 Karma

jplumsdaine22
Influencer

If you want to do it with markers, you will have to create a dashboard panel for each host. Each panel would have the following search

host=<your host> | stats count

Then just choose the marker guage visualization. If you want to view all your hosts side by side to look at abnormalities try

* |  stats count by host

and choose the line visualization.

But that's wasting Splunk's potential. Splunk can determine for you whether the volume is abnormal. For example, you could have Splunk alert you if a particular count is more than 3 standard deviations from the average - you'll never have to login again! (Although I understand every good NOC needs a dashboard full of numbers going up and down). Have a look at http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/CommonStatsFunctions for a list of statistical functions that you can apply to your data.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...