Dashboards & Visualizations

Need a query /dashboard that shows hostnames from /var/log/messages

dops1992
New Member

We have an index called syslog and we want to capture certain errors and report them in a dashboard with a graph as well as a table below that . Was wondering how to do that . I tried to add a dashboard and a panel but it only shows the graph.

Example

index=log host=pprdabcdek01 "reports path is down" this works great for one host
index=log host=pprd*k* OR host=pprd***l "tur checker reports path is down"| timechart count by host (This also works great but not sure if it is efficient) . Woudl like a better query that will cover more hosts like
pprdefghk01 or pprdabcask04 or pprderedbl01 or pprdrrsasl04 etc .....

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The easy option would be to cover all hosts, and remove the host= filter.

If you only want to view a set of hosts I'd recommend storing that set in a lookup file, and either filtering by an automatic lookup output field or using a subsearch like index=log [inputlookup that_lookup | fields host] ....

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...