Hello,
I want to check if a service on my client is running or not. I can check the service with the Windows System-Log.
This is working, but I don't find a way to display it in a dashboard.
If the service is running, there should be green indicator. If the service is not running, there should be a red indicator or something like that.
I am thankful for any tips!
Let us say that you have created a search that outputs a single row with 2 fields. One field is called host
and the other status
and status
can have at least 2 values, one of which is OK
. Use a search like this:
... | eval statusNum=if(status="OK",0,1) | rangemap field=statusNum low=0-0 severe=1-9999999 default=Severe
Click on the Visualization
tab, click on the left-most menu and select "Single Value". You will see your host
value in either red or green, depending on if it is "OK" (green) or not.
Let us say that you have created a search that outputs a single row with 2 fields. One field is called host
and the other status
and status
can have at least 2 values, one of which is OK
. Use a search like this:
... | eval statusNum=if(status="OK",0,1) | rangemap field=statusNum low=0-0 severe=1-9999999 default=Severe
Click on the Visualization
tab, click on the left-most menu and select "Single Value". You will see your host
value in either red or green, depending on if it is "OK" (green) or not.
I'm assuming that you have the required data already in Splunk to identify that a service is running or not. You would have to write a query to get the latest status of the service OR services and you can see the Splunk 6 dashboard example app see the format and sample on how to do the same.