Splunk Search

Summary Field = "OK" or "DOWN"

tmarlette
Motivator

I am currently attempting to create a 'summary' type of view within a dashboard stating that this list of services (svc1,svc2,svc3,svc4) are all running on the machine, but is only displaying and either "OK" or "DOWN" Status. If ANY of these services are down, this query should show the "DOWN" status, as this is just a summary panel.

The search I am working with currently is as follows:
sourcetype=WMI:Service (Name= OR Name= OR Name= OR name= OR Name=) | dedup host | eval State = if(State == Running, "OK", "Down") |table _time,host,Name,State| rename Name as "Service Name"

That being said, it gives me the display i'm looking for (1 status of either OK or DOWN per machine) though if 1 of the 5 services are down, the summary 'State' field doesn't change to "DOWN".

I suppose I'm attempting to summarize the running state of 5 services into one instance of either "OK" if all 5 services are running, but even if only 1 of them is not, then the summary field would switch to a "DOWN" state.

Let me know if I don't make sense right now.. i've been looking at these things all day, so I apologize for any minced words. Any help is greatly appreciated!

Tags (3)
0 Karma
1 Solution

aelliott
Motivator

You could order by State Ascending before deduping, then if there are any "down" it will show up top.. That seems like a much easier solution

That will require you to move your "if" statement though before the sort,dedup

| sort State | dedup etc.

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi tmarlette,

based on this use case ... the running state of 5 services into one instance of either "OK" if all 5 services are running, but even if only 1 of them is not, then the summary field would switch to a "DOWN" state. ... you can use a search like this:

 sourcetype=WMI:Service (Name=<svc_1> OR Name=<svc_2> OR Name=<svc_3> OR Name=<svc_4> OR Name=<svc_5>) | dedup host | eventstats count(eval(State="Running")) AS myCount | eval State=if(myCount=="5", "OK", "Down") | table _time,host,Name,State | rename Name as "Service Name"

this will count all the running states and if the count is 5 the State field is OK, if the count is not 5 the State field is Down.

hope this helps ...

cheers, MuS

tmarlette
Motivator

This answer works as well, so Thank you very much sir! I can only mark one answer, but I just tested this and it works well.

0 Karma

tmarlette
Motivator

yessir I do. i'm a little loopy at the moment.

0 Karma

aelliott
Motivator

You could order by State Ascending before deduping, then if there are any "down" it will show up top.. That seems like a much easier solution

That will require you to move your "if" statement though before the sort,dedup

| sort State | dedup etc.

tmarlette
Motivator

Nevermind I figured this out. thank you sir!!

0 Karma

tmarlette
Motivator

Could you show me how that would look?

0 Karma

aelliott
Motivator

you mean State="Running" right 😉

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...