From bdeeaab2152c00655119bd01692fa2a528c2c1ca Mon Sep 17 00:00:00 2001 From: sbylica-splunk Date: Mon, 3 Jun 2024 11:22:21 +0200 Subject: [PATCH 1/3] Added a dashboard POC --- dashboards/dashboard.xml | 269 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 269 insertions(+) create mode 100644 dashboards/dashboard.xml diff --git a/dashboards/dashboard.xml b/dashboards/dashboard.xml new file mode 100644 index 00000000..12bcc296 --- /dev/null +++ b/dashboards/dashboard.xml @@ -0,0 +1,269 @@ +
+ +
+ + + Event count + + + index=* sourcetype="cf:*" | timechart span=10m count + -24h + + 5m + delay + + + + + + + + + + + Distributions of events by index + + + index=* sourcetype="cf:*" | stats count by index + 0 + 1 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Total number of PCF events by index + + + index=* sourcetype="cf:*" | chart sparkline(count) AS "Indexes Trend" count AS Total BY index + 0 + + 1 + + + + + + + + + +
+ + + + + Events by sources + + + + -24h@h + now + + + + Events by source + + index=* sourcetype="cf:*" | top source + $source_time_range.earliest$ + $source_time_range.latest$ + + + + + + + + + + + Events by sourcetype + + + + -24h@h + now + + + + Events by sourcetype + + index=* sourcetype="cf:*" | top sourcetype + $source_time_range.earliest$ + $source_time_range.latest$ + + + + + + + + + + + + + Internal Splunk errors count + + + index=_internal component=HttpInputDataHandler (log_level="WARN" OR log_level="ERROR") | timechart span=10m count + -24h + + 5m + delay + + + + + + + + Internal Splunk errors sample + + + index=_internal component=HttpInputDataHandler (log_level="WARN" OR log_level="ERROR") | table name,parsing_err + 0 + 1 + + + + + +
+ + + + + + Nozzle errors count + + + index=* sourcetype="cf:splunknozzle" message="*error*" | timechart span=10m count + -24h + + 5m + delay + + + + + + + + Nozzle errors sample + + + index=* sourcetype="cf:splunknozzle" message="*error*" | table source,logger_source,message + 0 + 1 + + + + + +
+ + + + + + Nozzle CPU usage + + + | mstats avg("nozzle.usage.cpu") prestats=true WHERE "index"="pcf_metrics" span=10s | timechart avg("nozzle.usage.cpu") AS Avg span=10s | fields - _span* + -1h + + 5m + delay + + + + + + + + + + + Nozzle RAM usage + + + | mstats avg("nozzle.usage.ram") prestats=true WHERE "index"="pcf_metrics" span=10s | timechart avg("nozzle.usage.ram") AS Avg span=10s | fields - _span* + -1h + + 5m + delay + + + + + + + + + + + Nozzle events sent + + + | mstats rate_avg("firehose.events.received.count") as "Rate (Avg) /s" chart=true WHERE "index"="pcf_metrics" span=30s | fields - _span* + -1h + + 5m + delay + + + + + + + + Nozzle events dropped + + + | mstats rate_avg("firehose.events.dropped.count") as "Rate (Avg) /s" chart=true WHERE "index"="pcf_metrics" span=30s | fields - _span* + -1h + + 5m + delay + + + + + + + + + +
\ No newline at end of file From 1d549f1edb1101a6d34ae21a88dd41ae6162f953 Mon Sep 17 00:00:00 2001 From: sbylica-splunk Date: Mon, 1 Jul 2024 14:13:01 +0200 Subject: [PATCH 2/3] Cleanup of a dashboard --- dashboards/dashboard.xml | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/dashboards/dashboard.xml b/dashboards/dashboard.xml index 12bcc296..1d4d60db 100644 --- a/dashboards/dashboard.xml +++ b/dashboards/dashboard.xml @@ -1,4 +1,4 @@ -
+
@@ -12,7 +12,6 @@ 5m delay - @@ -52,14 +51,7 @@ - - - - - - - From 05f6b5be5feaa04b2a4d693a782873398495341e Mon Sep 17 00:00:00 2001 From: sbylica-splunk Date: Mon, 1 Jul 2024 14:14:59 +0200 Subject: [PATCH 3/3] fixed typo --- dashboards/dashboard.xml | 118 ++++++++++++++++++++------------------- 1 file changed, 60 insertions(+), 58 deletions(-) diff --git a/dashboards/dashboard.xml b/dashboards/dashboard.xml index 1d4d60db..af5318e7 100644 --- a/dashboards/dashboard.xml +++ b/dashboards/dashboard.xml @@ -1,14 +1,32 @@ - -
+ +
+ + + + -24h@h + now + + + + + * + * + + + + * + * + +
Event count - index=* sourcetype="cf:*" | timechart span=10m count - -24h - + index=$index_token$ sourcetype="cf:*" | timechart span=10m count + $main_time_range.earliest$ + $main_time_range.latest$ 5m delay @@ -23,8 +41,9 @@ Distributions of events by index - index=* sourcetype="cf:*" | stats count by index - 0 + index=$index_token$ sourcetype="cf:*" | stats count by index + $main_time_range.earliest$ + $main_time_range.latest$ 1 @@ -52,15 +71,16 @@ + Total number of PCF events by index - index=* sourcetype="cf:*" | chart sparkline(count) AS "Indexes Trend" count AS Total BY index - 0 - + index=$index_token$ sourcetype="cf:*" | chart sparkline(count) AS "Indexes Trend" count AS Total BY index + $main_time_range.earliest$ + $main_time_range.latest$ 1 @@ -77,19 +97,12 @@ Events by sources - - - - -24h@h - now - - Events by source - index=* sourcetype="cf:*" | top source - $source_time_range.earliest$ - $source_time_range.latest$ + index=$index_token$ sourcetype="cf:*" | top source + $main_time_range.earliest$ + $main_time_range.latest$ @@ -99,21 +112,14 @@ - + Events by sourcetype - - - - -24h@h - now - - Events by sourcetype - index=* sourcetype="cf:*" | top sourcetype - $source_time_range.earliest$ - $source_time_range.latest$ + index=$index_token$ sourcetype="cf:*" | top sourcetype + $main_time_range.earliest$ + $main_time_range.latest$ @@ -130,8 +136,8 @@ index=_internal component=HttpInputDataHandler (log_level="WARN" OR log_level="ERROR") | timechart span=10m count - -24h - + $main_time_range.earliest$ + $main_time_range.latest$ 5m delay @@ -144,8 +150,9 @@ Internal Splunk errors sample
- index=_internal component=HttpInputDataHandler (log_level="WARN" OR log_level="ERROR") | table name,parsing_err - 0 + index=_internal component=HttpInputDataHandler (log_level="WARN" OR log_level="ERROR") | table name,parsing_err | stats count by name,parsing_err + $main_time_range.earliest$ + $main_time_range.latest$ 1 @@ -155,15 +162,14 @@
- Nozzle errors count - index=* sourcetype="cf:splunknozzle" message="*error*" | timechart span=10m count - -24h - + index=$index_token$ sourcetype="cf:splunknozzle" message="*error*" | timechart span=10m count + $main_time_range.earliest$ + $main_time_range.latest$ 5m delay @@ -176,8 +182,9 @@ Nozzle errors sample - index=* sourcetype="cf:splunknozzle" message="*error*" | table source,logger_source,message - 0 + index=$index_token$ sourcetype="cf:splunknozzle" message="*error*" | table source,logger_source,message | stats count by source,logger_source,message + $main_time_range.earliest$ + $main_time_range.latest$ 1 @@ -187,15 +194,14 @@
- Nozzle CPU usage - | mstats avg("nozzle.usage.cpu") prestats=true WHERE "index"="pcf_metrics" span=10s | timechart avg("nozzle.usage.cpu") AS Avg span=10s | fields - _span* - -1h - + | mstats avg("nozzle.usage.cpu") prestats=true WHERE "index"=$metrics_index_token$ span=10s | timechart avg("nozzle.usage.cpu") AS Avg span=10s | fields - _span* + $main_time_range.earliest$ + $main_time_range.latest$ 5m delay @@ -205,15 +211,14 @@ - Nozzle RAM usage - | mstats avg("nozzle.usage.ram") prestats=true WHERE "index"="pcf_metrics" span=10s | timechart avg("nozzle.usage.ram") AS Avg span=10s | fields - _span* - -1h - + | mstats avg("nozzle.usage.ram") prestats=true WHERE "index"=$metrics_index_token$ span=10s | timechart avg("nozzle.usage.ram") AS Avg span=10s | fields - _span* + $main_time_range.earliest$ + $main_time_range.latest$ 5m delay @@ -223,15 +228,14 @@ - Nozzle events sent - | mstats rate_avg("firehose.events.received.count") as "Rate (Avg) /s" chart=true WHERE "index"="pcf_metrics" span=30s | fields - _span* - -1h - + | mstats rate_avg("firehose.events.received.count") as "Rate (Avg) /s" chart=true WHERE "index"=$metrics_index_token$ span=30s | fields - _span* + $main_time_range.earliest$ + $main_time_range.latest$ 5m delay @@ -244,9 +248,9 @@ Nozzle events dropped - | mstats rate_avg("firehose.events.dropped.count") as "Rate (Avg) /s" chart=true WHERE "index"="pcf_metrics" span=30s | fields - _span* - -1h - + | mstats rate_avg("firehose.events.dropped.count") as "Rate (Avg) /s" chart=true WHERE "index"=$metrics_index_token$ span=30s | fields - _span* + $main_time_range.earliest$ + $main_time_range.latest$ 5m delay @@ -256,6 +260,4 @@ - - \ No newline at end of file