Dashboards & Visualizations

How to display a message in dashboard like "PROCESS IS DOWN" when certain events showed up in log?

krishnacasso
Path Finder

I want to display a message in dashboard like "PROCESS IS DOWN" when certain events showed up in log.

"sm waiting for threads to terminate" OR
"sm proceeding with shutdown" OR
"sm is down" OR
"Thread pool stopped; proceeding with shutdown" OR
"Released sm"

If any of the string when occurred in log, I want to show a message like host and Process is down.

Thanks!

0 Karma
1 Solution

cmerriman
Super Champion
....|appendpipe [search "sm waiting for threads to terminate" OR "sm proceeding with shutdown" OR "sm is down" OR "Thread pool stopped; proceeding with shutdown" OR "Released sm"|eval newMessage="PROCESS IS DOWN"|table newMessage]|search newMessage=*|stats count by newMessage|fields - count

I tested this quicky on my system and it seems to work.

View solution in original post

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@krishnacasso - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post. If no, please leave a comment with more feedback. Thanks.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi krishnacasso,
try something like this:

your_search "sm waiting for threads to terminate" OR "sm proceeding with shutdown" OR "sm is down" OR "Thread pool stopped; proceeding with shutdown" OR "Released sm" | eval Message="PROCESS IS DOWN" | rex "(?<Error>(sm proceeding with shutdown)|(sm is down)|(Thread pool stopped; proceeding with shutdown)|(Released sm)) | table _time host Message Error

In this way you show TimeStamp, host, your message and in addition also the Error String you found.

Bye.
Giuseppe

0 Karma

cmerriman
Super Champion
....|appendpipe [search "sm waiting for threads to terminate" OR "sm proceeding with shutdown" OR "sm is down" OR "Thread pool stopped; proceeding with shutdown" OR "Released sm"|eval newMessage="PROCESS IS DOWN"|table newMessage]|search newMessage=*|stats count by newMessage|fields - count

I tested this quicky on my system and it seems to work.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...