Hi helpful people,
Is there a way of showing a marker gauge for each host in my network that shows the total amount of logs for the current day? I wish to display this on a dashboard so that we can easily determine whether a machine is outputting an abnormal amount of logs.
Any help would be truly appreciated.
If you want to do it with markers, you will have to create a dashboard panel for each host. Each panel would have the following search
host=<your host> | stats count
Then just choose the marker guage visualization. If you want to view all your hosts side by side to look at abnormalities try
* | stats count by host
and choose the line visualization.
But that's wasting Splunk's potential. Splunk can determine for you whether the volume is abnormal. For example, you could have Splunk alert you if a particular count is more than 3 standard deviations from the average - you'll never have to login again! (Although I understand every good NOC needs a dashboard full of numbers going up and down). Have a look at http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/CommonStatsFunctions for a list of statistical functions that you can apply to your data.