Sample Splunk Query

index="lamaxu" sourcetype="qmstatus_json" "identifier.dataType"=CHANNEL_STATUS "attributes.CHANNEL"!=SYSTEM.*|rename identifier.dataSource as qmgrName|rename attributes.CHANNEL as channelName|rename attributes.CONNS as connections |eval objName="(CONNS=".connections.") (".qmgrName.") ".channelName|chart useother=f max(connections) BY objName  limit=1000

Sample Dashboard

Sample Dashboard Source

<dashboard>
  <label>Channel Connection Count</label>
  <row>
    <panel>
      <title>Channel Connection Count</title>
      <single>
        <title>Channel Connection Count</title>
        <search>
          <query>index="lamaxu" sourcetype="qmstatus_json" "identifier.dataType"=CHANNEL_STATUS "attributes.CHANNEL"!=SYSTEM.*|rename identifier.dataSource as qmgrName|rename attributes.CHANNEL as channelName|rename attributes.CONNS as connections |eval objName="(CONNS=".connections.") (".qmgrName.") ".channelName|chart useother=f max(connections) BY objName  limit=1000</query>
          <earliest>rt-5m</earliest>
          <latest>rt</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">all</option>
        <option name="height">581</option>
        <option name="rangeColors">["0xd93f3c","0x65a637"]</option>
        <option name="rangeValues">[0]</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.scales.shared">0</option>
        <option name="trellis.size">small</option>
        <option name="underLabel">Connection Count</option>
        <option name="useColors">1</option>
      </single>
    </panel>
  </row>
</dashboard>
  • No labels