Getting Data In

Create dashboard to show vmware AlarmStatusChangedEvent until event goes from red to green

wilcoxj
New Member

I am running index=vmware-taskevent | spath eventClass | search eventClass=AlarmStatusChangedEvent and I want to have my dashboard show only the events that have not changed from red to green.

Here is the raw text:
{"entity": {"entity": {"moid": "host-145895", "type": "HostSystem"}, "name": "cpcdwesx02.na.cintas.com"}, "datacenter": {"datacenter": {"moid": "datacenter-21", "type": "Datacenter"}, "name": "Mason"}, "createdTime": "2020-02-05 21:17:48.765000+00:00", "alarm": {"alarm": {"moid": "alarm-1", "type": "Alarm"}, "name": "Host connection and power state"}, "source": {"entity": {"moid": "group-d1", "type": "Folder"}, "name": "Datacenters"}, "eventClass": "AlarmStatusChangedEvent", "chainId": "-1182388515", "host": {"host": {"moid": "host-145895", "type": "HostSystem"}, "name": "cpcdwesx02.na.cintas.com"}, "to": "green", "computeResource": {"computeResource": {"moid": "domain-s145893", "type": "ComputeResource"}, "name": "cpcdwesx02.na.cintas.com"}, "from": "red", "fullFormattedMessage": "Alarm 'Host connection and power state' on cpcdwesx02.na.cintas.com changed from Red to Green", "userName": "None", "key": "-1182388515"}

0 Karma

to4kawa
Ultra Champion

Sample:

|makeresults
| eval _raw="{\"entity\": {\"entity\": {\"moid\": \"host-145895\", \"type\": \"HostSystem\"}, \"name\": \"cpcdwesx02.na.cintas.com\"}, \"datacenter\": {\"datacenter\": {\"moid\": \"datacenter-21\", \"type\": \"Datacenter\"}, \"name\": \"Mason\"}, \"createdTime\": \"2020-02-05 21:17:48.765000+00:00\", \"alarm\": {\"alarm\": {\"moid\": \"alarm-1\", \"type\": \"Alarm\"}, \"name\": \"Host connection and power state\"}, \"source\": {\"entity\": {\"moid\": \"group-d1\", \"type\": \"Folder\"}, \"name\": \"Datacenters\"}, \"eventClass\": \"AlarmStatusChangedEvent\", \"chainId\": \"-1182388515\", \"host\": {\"host\": {\"moid\": \"host-145895\", \"type\": \"HostSystem\"}, \"name\": \"cpcdwesx02.na.cintas.com\"}, \"to\": \"green\", \"computeResource\": {\"computeResource\": {\"moid\": \"domain-s145893\", \"type\": \"ComputeResource\"}, \"name\": \"cpcdwesx02.na.cintas.com\"}, \"from\": \"red\", \"fullFormattedMessage\": \"Alarm 'Host connection and power state' on cpcdwesx02.na.cintas.com changed from Red to Green\", \"userName\": \"None\", \"key\": \"-1182388515\"}"
| spath createdTime
| spath eventClass
| spath from
| spath to
| table createdTime eventClass from to

query:

index=vmware-taskevent "AlarmStatusChangedEvent" NOT "changed from Red to Green"

dashboard:
As you like.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...