Dashboards & Visualizations

Splunk server status dashboard - code issue

bbraun
New Member

Hi,

I've done a lot of research and have applied many different "fixes" but none have seemed to work.

I'm trying to build a Splunk server status dashboard that shows either "OK" or "down". The two values that I'm working with are 0 and 1. 0 being OK and 1 being down.

I've tried adding rangemap (|rangemap field=Status low=0-0 severe=1-1 ) which didn't resolve my issue.

Can someone look at my code and determine what I'm doing wrong?

my version is 6.5.2

<dashboard>
  <label>SplunkHealth</label>
  <row>
    <panel>
      <title>Indexer 01</title>
      <single>
        <search>
          <query>|inputlookup all_servers.csv  | eval splunk_server=host  | join type=left   splunk_server [|rest /services/server/info]  | join type=left splunk_server [| rest /services/server/status/resource-usage/hostwide ]|fillnull value="Non-Reporting" | eval   Status=if(updated="Non-Reporting",1,0)  |rename splunk_server AS Server| search role=indexer |search Server=slpsplnkidl01 | table Status | eval Status=case(Status=0, "OK", Status=1, "DOWN")</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0xd93f3c"]</option>
        <option name="rangeValues">[0,1]</option>
        <option name="field">Status</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
  </row>
</dashboard>
0 Karma

DavidHourani
Super Champion

Hello bbraun,

You can do this via GUI by simply setting the color range when you click on --> Format Visualization -> color.
No need to edit this via code or anything. Your source should have the options bellow afterwards:

<panel>
  <single>
    <title>your title</title>
    <search>
      <query>your search</query>
      <earliest>$date1.earliest$</earliest>
      <latest>$date1.latest$</latest>
    </search>
    <option name="colorMode">block</option>
    <option name="rangeColors">["0x65a637","0xd93f3c"]</option>
    <option name="rangeValues">[0]</option>
    <option name="useColors">1</option>
  </single>
</panel>

Let me know how that goes for you.

Regards,
David

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi bbraun,
I usually use this search to diplay server status (where Perimeter.csv is a lookup containing all the server in my perimeter to monitor):

| metasearch index=_internal earliest=-300s latest=now
| eval host=upper(host) 
| stats count by host 
| append [ 
     | inputlookup Perimeter.csv 
     | eval count=0, host=upper(host)  
     ] 
| stats sum(count) AS Total by host 
| rangemap field=Total severe=0-0 low=1-1000000000 default=severe 
| table host range

I display status in graphic mode, to do this follw indications in "Table Icon Set (Rangemap)" dashboard of "Splunk 6.x Dashboard Examples" App.

Bye.
Giuseppe

0 Karma

jkat54
SplunkTrust
SplunkTrust

If colors is the issue try this:

 <option name="charting.fieldColors">{"DOWN":0xFF0000,"OK":0x00FF00}</option>

Basically saying if the value of Status is DOWN, red, if it's OK, green.

0 Karma

bbraun
New Member

When I add that line I receive the below error.

Warning on line 18: Unknown option name="charting.fieldColors" for node="single"

Should if be added to a specific line? Does any need to be removed?

0 Karma

DavidHourani
Super Champion

yes charting.fieldColors is for charts and not "single" panels.

0 Karma

jkat54
SplunkTrust
SplunkTrust

What's the problem?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...