|
Hi! I've installed Splunk for Nagios, and we're now getting lots of good service data, just waiting to be mined. Now, I'd like to be able to do two things. 1) When a service is severity="CRITICAL", change the color of that event on the chart. 2) Chart OK/WARNING/CRITIAL on the Y-Axis instead of the event count. Any help would be greatly appreciated. Thank you in advance! -Vincent |
|
You probably want to look at the stats, chart and timechart commands. These commands will allow you to mathematically and statistically manipulate the values of a given field and plot them against another field. The functions of stats, chart and timechart can be found on this documentation topic. Many usage examples are provided on the pages dedicated to the commands themselves. OK, I can extract the data fields I want, but I can't find an example of how to get something other than "count" on the Y Axis. If I do the following: index="nagios" host="nagios1" servicename="My Service"| timechart values(servicestatus) by src_host I get the data I want in tabular form, but the chart is still counting servicestatus events, whereas I'd prefer them to have different colors at least.
(29 Aug '11, 10:10)
choochee
|
