I have a process that I need to create a dashboard to monitor. The process logs to a file and contains easily searchable segment identifiers, such as:
Process started
Download started
bla
bla
Download completed
Import started
bla
bla
bla
Import completed
etc
etc
What is the best method of graphically displaying this on a dashboard? My thoughts were either a progress bar, or as a table listing each major step and an image that changes indicating the step's state (not started, running, finished). I haven't been able to figure out either one, although I got a lot closer on the table.
Any advice will be greatly appreciated!
Thank you in advance,
Jeremy
Hi jwinderDDS,
First get this messages into a field (let's say progress
) using field extractions, see the docs for more details http://docs.splunk.com/Documentation/Splunk/6.3.2/Knowledge/ExtractfieldsinteractivelywithIFX
Next create a automatic lookup base on this new field using a lookup table like this:
progress,state
Process started,started
Download started,running
Download completed,running
Import started,running
Import completed,finished
See the docs for more details on lookups and how they work http://docs.splunk.com/Documentation/Splunk/6.3.2/Knowledge/Addfieldsfromexternaldatasources
Once this is setup you can display the state
field in your dashboard.
Hope this helps to get you started ...
cheers, MuS
Hi jwinderDDS,
First get this messages into a field (let's say progress
) using field extractions, see the docs for more details http://docs.splunk.com/Documentation/Splunk/6.3.2/Knowledge/ExtractfieldsinteractivelywithIFX
Next create a automatic lookup base on this new field using a lookup table like this:
progress,state
Process started,started
Download started,running
Download completed,running
Import started,running
Import completed,finished
See the docs for more details on lookups and how they work http://docs.splunk.com/Documentation/Splunk/6.3.2/Knowledge/Addfieldsfromexternaldatasources
Once this is setup you can display the state
field in your dashboard.
Hope this helps to get you started ...
cheers, MuS
Thank you!
After creating dummy events using https://answers.splunk.com/answers/47493/how-do-you-add-dummy-events-to-a-search-result.html I was able to create a table view that refreshes every 30 seconds that updates a column with each step's current state.