|
12 | 12 | <fieldForLabel>ip</fieldForLabel> |
13 | 13 | <fieldForValue>ip</fieldForValue> |
14 | 14 | <search> |
15 | | - <query>index=* sourcetype="*:container:splunk-connect-for-snmp-*" "Scheduler: Sending due task sc4snmp;*;*;poll" | rex field=_raw "Sending due task sc4snmp;(?<ip>.+);(?<num>\d+);poll" | stats count by ip</query> |
| 15 | + <query>index=* sourcetype="*:container:splunk-connect-for-snmp-*" "Scheduler: Sending due task sc4snmp;*;*;poll" | rex field=_raw "Sending due task sc4snmp;(?<ip>.+):(?<port>\d+);(?<num>\d+);poll" | stats count by ip</query> |
16 | 16 | <earliest>-24h@h</earliest> |
17 | 17 | <latest>now</latest> |
18 | 18 | </search> |
19 | 19 | </input> |
20 | 20 | <chart> |
21 | 21 | <title>In case of unsuccessful polling status, please copy spl query from this chart and find failed tasks. Explanation of error log messages you can find at the https://splunk.github.io/splunk-connect-for-snmp/main/bestpractices/</title> |
22 | 22 | <search> |
23 | | - <query>index=* sourcetype="*:container:splunk-connect-for-snmp-*" splunk_connect_for_snmp.snmp.tasks.poll $poll_status_host$ | rex field=_raw "Task splunk_connect_for_snmp.*\[*\] (?<status>\w+)" | where status != "received" | timechart count by status</query> |
| 23 | + <query>index=* sourcetype="*:container:splunk-connect-for-snmp-*" splunk_connect_for_snmp.snmp.tasks.poll "$poll_status_host$" | rex field=_raw "Task splunk_connect_for_snmp.*\[*\] (?<status>\w+)" | where status != "received" | timechart count by status</query> |
24 | 24 | <earliest>-24h@h</earliest> |
25 | 25 | <latest>now</latest> |
26 | 26 | <refresh>5m</refresh> |
|
37 | 37 | <option name="refresh.display">progressbar</option> |
38 | 38 | <option name="trellis.enabled">0</option> |
39 | 39 | <drilldown> |
40 | | - <link target="_blank">search?q=index%3D*%20sourcetype%3D%22*%3Acontainer%3Asplunk-connect-for-snmp-*%22%20splunk_connect_for_snmp.snmp.tasks.poll%20$poll_status_host$%20%7C%20rex%20field%3D_raw%20%22Task%20splunk_connect_for_snmp.*%5C%5B*%5C%5D%20(%3F%3Cstatus%3E%5Cw%2B)%22%20%7C%20where%20status%20!%3D%20%22received%22&earliest=-24h@h&latest=now</link> |
| 40 | + <link target="_blank">search?q=index%3D*%20sourcetype%3D%22*%3Acontainer%3Asplunk-connect-for-snmp-*%22%20splunk_connect_for_snmp.snmp.tasks.poll%20%22$poll_status_host$%22%20%7C%20rex%20field%3D_raw%20%22Task%20splunk_connect_for_snmp.*%5C%5B*%5C%5D%20(%3F%3Cstatus%3E%5Cw%2B)%22%20%7C%20where%20status%20!%3D%20%22received%22&earliest=-24h@h&latest=now</link> |
41 | 41 | </drilldown> |
42 | 42 | </chart> |
43 | 43 | </panel> |
|
51 | 51 | <fieldForLabel>ip</fieldForLabel> |
52 | 52 | <fieldForValue>ip</fieldForValue> |
53 | 53 | <search> |
54 | | - <query>index=* sourcetype="*:container:splunk-connect-for-snmp-*" "Scheduler: Sending due task sc4snmp;*;*;poll" | rex field=_raw "Sending due task sc4snmp;(?<ip>.+);(?<num>\d+);poll" | stats count by ip</query> |
| 54 | + <query>index=* sourcetype="*:container:splunk-connect-for-snmp-*" "Scheduler: Sending due task sc4snmp;*;*;poll" | rex field=_raw "Sending due task sc4snmp;(?<ip>.+):(?<port>\d+);(?<num>\d+);poll" | stats count by ip</query> |
55 | 55 | <earliest>-24h@h</earliest> |
56 | 56 | <latest>now</latest> |
57 | 57 | </search> |
58 | 58 | </input> |
59 | 59 | <chart> |
60 | 60 | <title>Using this chart you can understand when SC4SNMP scheduled polling for your SNMP device last time. The process works if it runs regularly.</title> |
61 | 61 | <search> |
62 | | - <query>index=* sourcetype="*:container:splunk-connect-for-snmp-*" Scheduler: Sending due task sc4snmp;$poll_host$;*poll | timechart count</query> |
| 62 | + <query>index=* sourcetype="*:container:splunk-connect-for-snmp-*" Scheduler: Sending due task sc4snmp;*;*poll "$poll_host$" | timechart count</query> |
63 | 63 | <earliest>-24h@h</earliest> |
64 | 64 | <latest>now</latest> |
65 | 65 | <refresh>5m</refresh> |
|
70 | 70 | <option name="height">331</option> |
71 | 71 | <option name="refresh.display">progressbar</option> |
72 | 72 | <drilldown> |
73 | | - <link target="_blank">search?q=index%3D*%20sourcetype%3D%22*%3Acontainer%3Asplunk-connect-for-snmp-*%22%20Scheduler%3A%20Sending%20due%20task%20sc4snmp%3B$poll_host$%3B*poll&earliest=-24h@h&latest=now</link> |
| 73 | + <link target="_blank">search?q=index%3D*%20sourcetype%3D%22*%3Acontainer%3Asplunk-connect-for-snmp-*%22%20Scheduler%3A%20Sending%20due%20task%20sc4snmp%3B*%3B*poll%20%22$poll_host$%22&earliest=-24h@h&latest=now</link> |
74 | 74 | </drilldown> |
75 | 75 | </chart> |
76 | 76 | </panel> |
|
86 | 86 | <fieldForLabel>ip</fieldForLabel> |
87 | 87 | <fieldForValue>ip</fieldForValue> |
88 | 88 | <search> |
89 | | - <query>index=* sourcetype="*:container:splunk-connect-for-snmp-*" "Scheduler: Sending due task sc4snmp;*;walk" | rex field=_raw "Sending due task sc4snmp;(?<ip>.+);walk" | stats count by ip</query> |
| 89 | + <query>index=* sourcetype="*:container:splunk-connect-for-snmp-*" "Scheduler: Sending due task sc4snmp;*;walk" | rex field=_raw "Sending due task sc4snmp;(?<ip>.+):(?<port>\d+);walk" | stats count by ip</query> |
90 | 90 | <earliest>-24h@h</earliest> |
91 | 91 | <latest>now</latest> |
92 | 92 | </search> |
93 | 93 | </input> |
94 | 94 | <chart> |
95 | 95 | <title>In case of unsuccessful walk status, please copy spl query from this chart and find failed tasks. Explanation of error log messages you can find at the https://splunk.github.io/splunk-connect-for-snmp/main/bestpractices/</title> |
96 | 96 | <search> |
97 | | - <query>index=* sourcetype="*:container:splunk-connect-for-snmp-*" splunk_connect_for_snmp.snmp.tasks.walk $walk_status_host$ | rex field=_raw "Task splunk_connect_for_snmp.*\[*\] (?<status>\w+)" | where status != "received" | timechart count by status</query> |
| 97 | + <query>index=* sourcetype="*:container:splunk-connect-for-snmp-*" splunk_connect_for_snmp.snmp.tasks.walk "$walk_status_host$" | rex field=_raw "Task splunk_connect_for_snmp.*\[*\] (?<status>\w+)" | where status != "received" | timechart count by status</query> |
98 | 98 | <earliest>-24h@h</earliest> |
99 | 99 | <latest>now</latest> |
100 | 100 | <refresh>5m</refresh> |
|
105 | 105 | <option name="height">327</option> |
106 | 106 | <option name="refresh.display">progressbar</option> |
107 | 107 | <drilldown> |
108 | | - <link target="_blank">search?q=index%3D*%20sourcetype%3D%22kube%3Acontainer%3Asplunk-connect-for-snmp-*%22%20splunk_connect_for_snmp.snmp.tasks.walk%20$walk_status_host$%20%7C%20rex%20field%3D_raw%20%22Task%20splunk_connect_for_snmp.*%5C%5B*%5C%5D%20(%3F%3Cstatus%3E%5Cw%2B)%22%20%7C%20where%20status%20!%3D%20%22received%22&earliest=-24h@h&latest=now</link> |
| 108 | + <link target="_blank">search?q=index%3D*%20sourcetype%3D%22kube%3Acontainer%3Asplunk-connect-for-snmp-*%22%20splunk_connect_for_snmp.snmp.tasks.walk%20%22$walk_status_host$%22%20%7C%20rex%20field%3D_raw%20%22Task%20splunk_connect_for_snmp.*%5C%5B*%5C%5D%20(%3F%3Cstatus%3E%5Cw%2B)%22%20%7C%20where%20status%20!%3D%20%22received%22&earliest=-24h@h&latest=now</link> |
109 | 109 | </drilldown> |
110 | 110 | </chart> |
111 | 111 | </panel> |
|
119 | 119 | <fieldForLabel>ip</fieldForLabel> |
120 | 120 | <fieldForValue>ip</fieldForValue> |
121 | 121 | <search> |
122 | | - <query>index=* sourcetype="*:container:splunk-connect-for-snmp-*" "Scheduler: Sending due task sc4snmp;*;walk" | rex field=_raw "Sending due task sc4snmp;(?<ip>.+);walk" | stats count by ip</query> |
| 122 | + <query>index=* sourcetype="*:container:splunk-connect-for-snmp-*" "Scheduler: Sending due task sc4snmp;*;walk" | rex field=_raw "Sending due task sc4snmp;(?<ip>.+):(?<port>\d+);walk" | stats count by ip</query> |
123 | 123 | <earliest>-24h@h</earliest> |
124 | 124 | <latest>now</latest> |
125 | 125 | </search> |
126 | 126 | </input> |
127 | 127 | <chart> |
128 | 128 | <title>Using this chart you can understand when SC4SNMP scheduled walk for your SNMP device last time. The process works if it runs regularly.</title> |
129 | 129 | <search> |
130 | | - <query>index=* sourcetype="*:container:splunk-connect-for-snmp-*" Scheduler: Sending due task sc4snmp;$walk_host$;walk | timechart count</query> |
| 130 | + <query>index=* sourcetype="*:container:splunk-connect-for-snmp-*" Scheduler: Sending due task sc4snmp;*;walk "$walk_host$" | timechart count</query> |
131 | 131 | <earliest>-24h@h</earliest> |
132 | 132 | <latest>now</latest> |
133 | 133 | <refresh>5m</refresh> |
|
138 | 138 | <option name="height">324</option> |
139 | 139 | <option name="refresh.display">progressbar</option> |
140 | 140 | <drilldown> |
141 | | - <link target="_blank">search?q=index%3D*%20sourcetype%3D%22*%3Acontainer%3Asplunk-connect-for-snmp-*%22%20Scheduler%3A%20Sending%20due%20task%20sc4snmp%3B$walk_host$%3Bwalk&earliest=-24h@h&latest=now</link> |
| 141 | + <link target="_blank">search?q=index%3D*%20sourcetype%3D%22*%3Acontainer%3Asplunk-connect-for-snmp-*%22%20Scheduler%3A%20Sending%20due%20task%20sc4snmp%3B*%3Bwalk%20%22$walk_host$%22&earliest=-24h@h&latest=now</link> |
142 | 142 | </drilldown> |
143 | 143 | </chart> |
144 | 144 | </panel> |
|
0 commit comments