Skip to content

Commit a0eafb9

Browse files
sbylica-splunksbylica-splunk
authored
Added a PCF dashboard (#372)
* Added a dashboard POC
1 parent 31f5369 commit a0eafb9

File tree

1 file changed

+263
-0
lines changed

1 file changed

+263
-0
lines changed

‎dashboards/dashboard.xml

Lines changed: 263 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,263 @@
1+
<form version="1.1" hideEdit="false">
2+
<label>PCF dashboard</label>
3+
<fieldset submitButton="false">
4+
<input type="time" token="main_time_range" searchWhenChanged="true">
5+
<label>Time range</label>
6+
<default>
7+
<earliest>-24h@h</earliest>
8+
<latest>now</latest>
9+
</default>
10+
</input>
11+
<input type="text" token="index_token" searchWhenChanged="true">
12+
<label>Index</label>
13+
<default>*</default>
14+
<initialValue>*</initialValue>
15+
</input>
16+
<input type="text" token="metrics_index_token" searchWhenChanged="true">
17+
<label>Metrics index</label>
18+
<default>*</default>
19+
<initialValue>*</initialValue>
20+
</input>
21+
</fieldset>
22+
<row>
23+
<panel>
24+
<title>Event count</title>
25+
<chart>
26+
<search>
27+
<query>index=$index_token$ sourcetype="cf:*" | timechart span=10m count </query>
28+
<earliest>$main_time_range.earliest$</earliest>
29+
<latest>$main_time_range.latest$</latest>
30+
<refresh>5m</refresh>
31+
<refreshType>delay</refreshType>
32+
</search>
33+
<option name="charting.chart">line</option>
34+
<option name="charting.drilldown">none</option>
35+
<option name="refresh.display">progressbar</option>
36+
</chart>
37+
</panel>
38+
</row>
39+
<row>
40+
<panel>
41+
<title>Distributions of events by index</title>
42+
<chart>
43+
<search>
44+
<query>index=$index_token$ sourcetype="cf:*" | stats count by index</query>
45+
<earliest>$main_time_range.earliest$</earliest>
46+
<latest>$main_time_range.latest$</latest>
47+
<sampleRatio>1</sampleRatio>
48+
</search>
49+
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
50+
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
51+
<option name="charting.axisTitleX.visibility">visible</option>
52+
<option name="charting.axisTitleY.visibility">visible</option>
53+
<option name="charting.axisTitleY2.visibility">visible</option>
54+
<option name="charting.axisX.abbreviation">none</option>
55+
<option name="charting.axisX.scale">linear</option>
56+
<option name="charting.axisY.abbreviation">none</option>
57+
<option name="charting.axisY.scale">linear</option>
58+
<option name="charting.axisY2.abbreviation">none</option>
59+
<option name="charting.axisY2.enabled">0</option>
60+
<option name="charting.axisY2.scale">inherit</option>
61+
<option name="charting.chart">pie</option>
62+
<option name="charting.chart.bubbleMaximumSize">50</option>
63+
<option name="charting.chart.bubbleMinimumSize">10</option>
64+
<option name="charting.chart.bubbleSizeBy">area</option>
65+
<option name="charting.chart.nullValueMode">gaps</option>
66+
<option name="charting.chart.showDataLabels">none</option>
67+
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
68+
<option name="charting.chart.stackMode">default</option>
69+
<option name="charting.chart.style">shiny</option>
70+
<option name="charting.drilldown">none</option>
71+
<option name="charting.layout.splitSeries">0</option>
72+
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
73+
<option name="charting.lineWidth">2</option>
74+
<option name="refresh.display">progressbar</option>
75+
</chart>
76+
</panel>
77+
<panel>
78+
<title>Total number of PCF events by index</title>
79+
<table>
80+
<search>
81+
<query>index=$index_token$ sourcetype="cf:*" | chart sparkline(count) AS "Indexes Trend" count AS Total BY index</query>
82+
<earliest>$main_time_range.earliest$</earliest>
83+
<latest>$main_time_range.latest$</latest>
84+
<sampleRatio>1</sampleRatio>
85+
</search>
86+
<option name="count">20</option>
87+
<option name="dataOverlayMode">none</option>
88+
<option name="drilldown">none</option>
89+
<option name="percentagesRow">false</option>
90+
<option name="refresh.display">progressbar</option>
91+
<option name="rowNumbers">false</option>
92+
<option name="totalsRow">false</option>
93+
<option name="wrap">true</option>
94+
</table>
95+
</panel>
96+
</row>
97+
<row>
98+
<panel>
99+
<title>Events by sources</title>
100+
<chart>
101+
<title>Events by source</title>
102+
<search>
103+
<query>index=$index_token$ sourcetype="cf:*" | top source</query>
104+
<earliest>$main_time_range.earliest$</earliest>
105+
<latest>$main_time_range.latest$</latest>
106+
</search>
107+
<option name="charting.axisY.abbreviation">none</option>
108+
<option name="charting.chart">pie</option>
109+
<option name="charting.chart.showDataLabels">all</option>
110+
<option name="charting.drilldown">none</option>
111+
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
112+
<option name="refresh.display">progressbar</option>
113+
</chart>
114+
</panel>
115+
<panel>
116+
<title>Events by sourcetype</title>
117+
<chart>
118+
<title>Events by sourcetype</title>
119+
<search>
120+
<query>index=$index_token$ sourcetype="cf:*" | top sourcetype</query>
121+
<earliest>$main_time_range.earliest$</earliest>
122+
<latest>$main_time_range.latest$</latest>
123+
</search>
124+
<option name="charting.axisY.abbreviation">none</option>
125+
<option name="charting.chart">pie</option>
126+
<option name="charting.chart.showDataLabels">all</option>
127+
<option name="charting.drilldown">none</option>
128+
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
129+
<option name="refresh.display">progressbar</option>
130+
</chart>
131+
</panel>
132+
</row>
133+
<row>
134+
<panel>
135+
<title>Internal Splunk errors count</title>
136+
<chart>
137+
<search>
138+
<query>index=_internal component=HttpInputDataHandler (log_level="WARN" OR log_level="ERROR") | timechart span=10m count </query>
139+
<earliest>$main_time_range.earliest$</earliest>
140+
<latest>$main_time_range.latest$</latest>
141+
<refresh>5m</refresh>
142+
<refreshType>delay</refreshType>
143+
</search>
144+
<option name="charting.chart">line</option>
145+
<option name="charting.drilldown">none</option>
146+
<option name="refresh.display">progressbar</option>
147+
</chart>
148+
</panel>
149+
<panel>
150+
<title>Internal Splunk errors sample</title>
151+
<table>
152+
<search>
153+
<query>index=_internal component=HttpInputDataHandler (log_level="WARN" OR log_level="ERROR") | table name,parsing_err | stats count by name,parsing_err </query>
154+
<earliest>$main_time_range.earliest$</earliest>
155+
<latest>$main_time_range.latest$</latest>
156+
<sampleRatio>1</sampleRatio>
157+
</search>
158+
<option name="drilldown">none</option>
159+
<option name="trellis.enabled">0</option>
160+
<option name="trellis.scales.shared">1</option>
161+
<option name="trellis.size">medium</option>
162+
</table>
163+
</panel>
164+
</row>
165+
<row>
166+
<panel>
167+
<title>Nozzle errors count</title>
168+
<chart>
169+
<search>
170+
<query>index=$index_token$ sourcetype="cf:splunknozzle" message="*error*" | timechart span=10m count </query>
171+
<earliest>$main_time_range.earliest$</earliest>
172+
<latest>$main_time_range.latest$</latest>
173+
<refresh>5m</refresh>
174+
<refreshType>delay</refreshType>
175+
</search>
176+
<option name="charting.chart">line</option>
177+
<option name="charting.drilldown">none</option>
178+
<option name="refresh.display">progressbar</option>
179+
</chart>
180+
</panel>
181+
<panel>
182+
<title>Nozzle errors sample</title>
183+
<table>
184+
<search>
185+
<query>index=$index_token$ sourcetype="cf:splunknozzle" message="*error*" | table source,logger_source,message | stats count by source,logger_source,message </query>
186+
<earliest>$main_time_range.earliest$</earliest>
187+
<latest>$main_time_range.latest$</latest>
188+
<sampleRatio>1</sampleRatio>
189+
</search>
190+
<option name="drilldown">none</option>
191+
<option name="trellis.enabled">0</option>
192+
<option name="trellis.scales.shared">1</option>
193+
<option name="trellis.size">medium</option>
194+
</table>
195+
</panel>
196+
</row>
197+
<row>
198+
<panel>
199+
<title>Nozzle CPU usage</title>
200+
<chart>
201+
<search>
202+
<query>| mstats avg("nozzle.usage.cpu") prestats=true WHERE "index"=$metrics_index_token$ span=10s | timechart avg("nozzle.usage.cpu") AS Avg span=10s | fields - _span* </query>
203+
<earliest>$main_time_range.earliest$</earliest>
204+
<latest>$main_time_range.latest$</latest>
205+
<refresh>5m</refresh>
206+
<refreshType>delay</refreshType>
207+
</search>
208+
<option name="charting.chart">line</option>
209+
<option name="charting.drilldown">none</option>
210+
<option name="refresh.display">progressbar</option>
211+
</chart>
212+
</panel>
213+
</row>
214+
<row>
215+
<panel>
216+
<title>Nozzle RAM usage</title>
217+
<chart>
218+
<search>
219+
<query>| mstats avg("nozzle.usage.ram") prestats=true WHERE "index"=$metrics_index_token$ span=10s | timechart avg("nozzle.usage.ram") AS Avg span=10s | fields - _span* </query>
220+
<earliest>$main_time_range.earliest$</earliest>
221+
<latest>$main_time_range.latest$</latest>
222+
<refresh>5m</refresh>
223+
<refreshType>delay</refreshType>
224+
</search>
225+
<option name="charting.chart">line</option>
226+
<option name="charting.drilldown">none</option>
227+
<option name="refresh.display">progressbar</option>
228+
</chart>
229+
</panel>
230+
</row>
231+
<row>
232+
<panel>
233+
<title>Nozzle events sent</title>
234+
<chart>
235+
<search>
236+
<query> | mstats rate_avg("firehose.events.received.count") as "Rate (Avg) /s" chart=true WHERE "index"=$metrics_index_token$ span=30s | fields - _span* </query>
237+
<earliest>$main_time_range.earliest$</earliest>
238+
<latest>$main_time_range.latest$</latest>
239+
<refresh>5m</refresh>
240+
<refreshType>delay</refreshType>
241+
</search>
242+
<option name="charting.chart">line</option>
243+
<option name="charting.drilldown">none</option>
244+
<option name="refresh.display">progressbar</option>
245+
</chart>
246+
</panel>
247+
<panel>
248+
<title>Nozzle events dropped</title>
249+
<chart>
250+
<search>
251+
<query> | mstats rate_avg("firehose.events.dropped.count") as "Rate (Avg) /s" chart=true WHERE "index"=$metrics_index_token$ span=30s | fields - _span* </query>
252+
<earliest>$main_time_range.earliest$</earliest>
253+
<latest>$main_time_range.latest$</latest>
254+
<refresh>5m</refresh>
255+
<refreshType>delay</refreshType>
256+
</search>
257+
<option name="charting.chart">line</option>
258+
<option name="charting.drilldown">none</option>
259+
<option name="refresh.display">progressbar</option>
260+
</chart>
261+
</panel>
262+
</row>
263+
</form>

0 commit comments

Comments
 (0)