I want to create a Splunk table that shows server status.
I have a query that returns the server and it’s type, currently.
But, I can’t figure out how to show it’s status, I.e. whether it’s OK or if there’s an error.
I need to match anything that resembles an ‘200’ http status with “OK”, and anything with an error message with “ERROR”
| eval status=case(
match(_raw, "HTTP/1.1" 200"), "OK",
match(_raw, "ERROR"), "ERROR",
true(), "Unknown")
However, I am not sure how to show this in my table.
I am only interested in select few servers that are hardcoded in the query.
Here’s what I have so far, which shows the server name, and node type.
index=app
| WHERE host IN ("dgp4ds2345", "dgp4ds2346", "dgp4ds2347", "dgp4ds2348", "dgp4ds2349")
| eval node_type=case(
host IN ("dgp4ds2345", "dgp4ds2346", "dgp4ds2347"), "processor",
host IN ("dgp4ds2348", "dgp4ds2349"), "storage")
| table server, type, primary
Here’s what I wany my table to look like, ultimately:
| server | type | primary |
|---|---|---|
| dgp4ds2345 | processor | OK |
| dgp4ds2487 | processor | OK |
| dgp4ds2289 | storage | OK |
You have the code. Does it work if you put the pieces together? If not, what you get?
index=app host IN ("dgp4ds2345", "dgp4ds2346", "dgp4ds2347", "dgp4ds2348", "dgp4ds2349")
| eval type=case(
host IN ("dgp4ds2345", "dgp4ds2346", "dgp4ds2347"), "processor",
host IN ("dgp4ds2348", "dgp4ds2349"), "storage")
| eval primary=case(
match(_raw, "HTTP/1.1" 200"), "OK",
match(_raw, "ERROR"), "ERROR",
true(), "Unknown")
| rename host as server
| table server, type, primary
1