Skip to content

Instantly share code, notes, and snippets.

@christineywang

christineywang/splunk + servicenow

Created July 21, 2020 19:48
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save christineywang/f84197afac2d952c146907c0207c8df4 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save christineywang/f84197afac2d952c146907c0207c8df4 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
splunk + servicenow
{
"annotations": {
"list": [
{
"builtIn": 1,
"datasource": "-- Grafana --",
"enable": true,
"hide": true,
"iconColor": "rgba(0, 211, 255, 1)",
"name": "Annotations & Alerts",
"type": "dashboard"
}
]
},
"editable": true,
"gnetId": null,
"graphTooltip": 0,
"id": 36,
"links": [],
"panels": [
{
"datasource": null,
"fieldConfig": {
"defaults": {
"custom": {},
"mappings": [],
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "red",
"value": 80
}
]
}
},
"overrides": []
},
"gridPos": {
"h": 8,
"w": 6,
"x": 0,
"y": 0
},
"id": 9,
"options": {
"colorMode": "value",
"graphMode": "area",
"justifyMode": "auto",
"orientation": "auto",
"reduceOptions": {
"calcs": [
"first"
],
"fields": "",
"values": false
}
},
"pluginVersion": "7.0.3",
"targets": [
{
"binOptions": {
"bins": null
},
"index": "select index",
"metricAggs": [
{
"alias": "",
"field": "select field",
"func": "avg"
}
],
"options": {
"cont": true,
"limit": null,
"partial": true
},
"query": "source=docker_inspect| spath Name | spath \"State.Status\" | search Name=* State.Status=running | timechart count span=2mins",
"rawQuery": true,
"refId": "A",
"sourcetype": "select sourcetype",
"splitByFields": [],
"tcOptions": {
"nullstr": "",
"otherstr": "",
"span": "auto",
"usenull": false,
"useother": true
},
"whereClause": {
"value": ""
}
}
],
"timeFrom": null,
"timeShift": null,
"title": "Running Containers",
"transformations": [
{
"id": "filterFieldsByName",
"options": {
"include": {
"names": [
"_time",
"count"
]
}
}
}
],
"type": "stat"
},
{
"aliasColors": {},
"bars": true,
"dashLength": 10,
"dashes": false,
"datasource": null,
"fieldConfig": {
"defaults": {
"custom": {}
},
"overrides": []
},
"fill": 1,
"fillGradient": 0,
"gridPos": {
"h": 8,
"w": 6,
"x": 6,
"y": 0
},
"hiddenSeries": false,
"id": 11,
"legend": {
"avg": false,
"current": false,
"max": false,
"min": false,
"show": true,
"total": false,
"values": false
},
"lines": false,
"linewidth": 1,
"nullPointMode": "null",
"options": {
"dataLinks": []
},
"percentage": false,
"pointradius": 2,
"points": false,
"renderer": "flot",
"seriesOverrides": [],
"spaceLength": 10,
"stack": true,
"steppedLine": false,
"targets": [
{
"binOptions": {
"bins": null
},
"index": "select index",
"metricAggs": [
{
"alias": "",
"field": "select field",
"func": "avg"
}
],
"options": {
"cont": true,
"limit": null,
"partial": true
},
"query": "sourcetype=\"container:log\" | lookup docker_containername containerid as host OUTPUT containername as container_name | search container_name=* | timechart count by container_name",
"rawQuery": true,
"refId": "A",
"sourcetype": "select sourcetype",
"splitByFields": [],
"tcOptions": {
"nullstr": "",
"otherstr": "",
"span": "auto",
"usenull": false,
"useother": true
},
"whereClause": {
"value": ""
}
}
],
"thresholds": [],
"timeFrom": null,
"timeRegions": [],
"timeShift": null,
"title": "Logs by Container - File Input",
"tooltip": {
"shared": true,
"sort": 0,
"value_type": "individual"
},
"type": "graph",
"xaxis": {
"buckets": null,
"mode": "time",
"name": null,
"show": true,
"values": []
},
"yaxes": [
{
"format": "short",
"label": null,
"logBase": 1,
"max": null,
"min": null,
"show": true
},
{
"format": "short",
"label": null,
"logBase": 1,
"max": null,
"min": null,
"show": true
}
],
"yaxis": {
"align": false,
"alignLevel": null
}
},
{
"aliasColors": {},
"bars": false,
"dashLength": 10,
"dashes": false,
"datasource": "Splunk",
"fieldConfig": {
"defaults": {
"custom": {}
},
"overrides": []
},
"fill": 1,
"fillGradient": 0,
"gridPos": {
"h": 7,
"w": 12,
"x": 12,
"y": 0
},
"hiddenSeries": false,
"id": 4,
"legend": {
"avg": false,
"current": false,
"max": false,
"min": false,
"show": true,
"total": false,
"values": false
},
"lines": true,
"linewidth": 1,
"links": [],
"nullPointMode": "null",
"options": {
"dataLinks": [
{
"title": "View in Splunk",
"url": "http://localhost:8000/en-US/app/app-docker/docker_overview?form.time.earliest=rt-30m&form.time.latest=rt&form.container_name=${__series.name}"
}
]
},
"percentage": false,
"pointradius": 5,
"points": false,
"renderer": "flot",
"seriesOverrides": [],
"spaceLength": 10,
"stack": true,
"steppedLine": false,
"targets": [
{
"binOptions": {
"bins": null
},
"index": "select index",
"metricAggs": [
{
"alias": "",
"field": "select field",
"func": "avg"
}
],
"namespace": "app-docker",
"options": {
"cont": true,
"limit": null,
"partial": true
},
"query": "|savedsearch network_output_by_container container_name=*",
"rawQuery": true,
"refId": "A",
"resultFormat": "time_series",
"sourcetype": "select sourcetype",
"splitByFields": [],
"target": "",
"tcOptions": {
"nullstr": "",
"otherstr": "",
"span": "auto",
"usenull": false,
"useother": true
},
"whereClause": {
"agg": "avg",
"condition": "",
"operator": "",
"type": null,
"value": ""
}
}
],
"thresholds": [],
"timeFrom": null,
"timeRegions": [],
"timeShift": null,
"title": "Network Output (Kb)",
"tooltip": {
"shared": true,
"sort": 0,
"value_type": "individual"
},
"type": "graph",
"xaxis": {
"buckets": null,
"mode": "time",
"name": null,
"show": true,
"values": []
},
"yaxes": [
{
"format": "Kbits",
"label": null,
"logBase": 1,
"max": null,
"min": "0",
"show": true
},
{
"format": "short",
"label": null,
"logBase": 1,
"max": null,
"min": null,
"show": true
}
],
"yaxis": {
"align": false,
"alignLevel": null
}
},
{
"aliasColors": {},
"bars": false,
"dashLength": 10,
"dashes": false,
"datasource": "Splunk",
"fieldConfig": {
"defaults": {
"custom": {}
},
"overrides": []
},
"fill": 1,
"fillGradient": 0,
"gridPos": {
"h": 7,
"w": 12,
"x": 12,
"y": 7
},
"hiddenSeries": false,
"id": 6,
"legend": {
"avg": false,
"current": false,
"max": false,
"min": false,
"show": true,
"total": false,
"values": false
},
"lines": true,
"linewidth": 1,
"links": [],
"nullPointMode": "null",
"options": {
"dataLinks": [
{
"title": "View in Splunk",
"url": "http://localhost:8000/en-US/app/app-docker/docker_overview?form.time.earliest=rt-30m&form.time.latest=rt&form.container_name=${__series.name}"
}
]
},
"percentage": false,
"pointradius": 5,
"points": false,
"renderer": "flot",
"seriesOverrides": [],
"spaceLength": 10,
"stack": true,
"steppedLine": false,
"targets": [
{
"binOptions": {
"bins": null
},
"index": "select index",
"metricAggs": [
{
"alias": "",
"field": "select field",
"func": "avg"
}
],
"namespace": "app-docker",
"options": {
"cont": true,
"limit": null,
"partial": true
},
"query": "|savedsearch block_output_by_container container_name=*",
"rawQuery": true,
"refId": "A",
"resultFormat": "time_series",
"sourcetype": "select sourcetype",
"splitByFields": [],
"target": "",
"tcOptions": {
"nullstr": "",
"otherstr": "",
"span": "auto",
"usenull": false,
"useother": true
},
"whereClause": {
"agg": "avg",
"condition": "",
"operator": "",
"type": null,
"value": ""
}
}
],
"thresholds": [],
"timeFrom": null,
"timeRegions": [],
"timeShift": null,
"title": "Block Output (Kb)",
"tooltip": {
"shared": true,
"sort": 0,
"value_type": "individual"
},
"type": "graph",
"xaxis": {
"buckets": null,
"mode": "time",
"name": null,
"show": true,
"values": []
},
"yaxes": [
{
"format": "Kbits",
"label": null,
"logBase": 1,
"max": null,
"min": "0",
"show": true
},
{
"format": "short",
"label": null,
"logBase": 1,
"max": null,
"min": null,
"show": true
}
],
"yaxis": {
"align": false,
"alignLevel": null
}
},
{
"aliasColors": {},
"bars": false,
"dashLength": 10,
"dashes": false,
"datasource": "Splunk",
"fieldConfig": {
"defaults": {
"custom": {}
},
"overrides": []
},
"fill": 1,
"fillGradient": 0,
"gridPos": {
"h": 7,
"w": 12,
"x": 0,
"y": 8
},
"hiddenSeries": false,
"id": 1,
"legend": {
"avg": false,
"current": false,
"max": false,
"min": false,
"show": true,
"total": false,
"values": false
},
"lines": true,
"linewidth": 1,
"links": [],
"nullPointMode": "null",
"options": {
"dataLinks": [
{
"title": "View in Splunk",
"url": "http://localhost:8000/en-US/app/app-docker/docker_overview?form.time.earliest=rt-30m&form.time.latest=rt&form.container_name=${__series.name}"
}
]
},
"percentage": false,
"pointradius": 5,
"points": false,
"renderer": "flot",
"seriesOverrides": [],
"spaceLength": 10,
"stack": true,
"steppedLine": false,
"targets": [
{
"binOptions": {
"bins": null
},
"index": "select index",
"metricAggs": [
{
"alias": "",
"field": "select field",
"func": "avg"
}
],
"namespace": "app-docker",
"options": {
"cont": true,
"limit": null,
"partial": true
},
"query": "|savedsearch cpu_max_by_container container_name=*",
"rawQuery": true,
"refId": "A",
"resultFormat": "time_series",
"sourcetype": "select sourcetype",
"splitByFields": [],
"target": "",
"tcOptions": {
"nullstr": "",
"otherstr": "",
"span": "auto",
"usenull": false,
"useother": true
},
"whereClause": {
"agg": "avg",
"condition": "",
"operator": "",
"type": null,
"value": ""
}
}
],
"thresholds": [],
"timeFrom": null,
"timeRegions": [],
"timeShift": null,
"title": "CPU Usage - Max by container",
"tooltip": {
"shared": true,
"sort": 0,
"value_type": "individual"
},
"type": "graph",
"xaxis": {
"buckets": null,
"mode": "time",
"name": null,
"show": true,
"values": []
},
"yaxes": [
{
"format": "percent",
"label": null,
"logBase": 1,
"max": null,
"min": "0",
"show": true
},
{
"format": "short",
"label": null,
"logBase": 1,
"max": null,
"min": null,
"show": true
}
],
"yaxis": {
"align": false,
"alignLevel": null
}
},
{
"datasource": null,
"fieldConfig": {
"defaults": {
"custom": {}
},
"overrides": []
},
"gridPos": {
"h": 8,
"w": 12,
"x": 0,
"y": 15
},
"id": 13,
"options": {
"showLabels": false,
"showTime": false,
"sortOrder": "Descending",
"wrapLogMessage": false
},
"targets": [
{
"binOptions": {
"bins": null
},
"index": "select index",
"metricAggs": [
{
"alias": "",
"field": "select field",
"func": "avg"
}
],
"options": {
"cont": true,
"limit": null,
"partial": true
},
"query": "",
"rawQuery": true,
"refId": "A",
"sourcetype": "select sourcetype",
"splitByFields": [],
"tcOptions": {
"nullstr": "",
"otherstr": "",
"span": "auto",
"usenull": false,
"useother": true
},
"whereClause": {
"value": ""
}
}
],
"timeFrom": null,
"timeShift": null,
"title": "Splunk Logs",
"type": "logs"
},
{
"aliasColors": {},
"bars": false,
"dashLength": 10,
"dashes": false,
"datasource": "Splunk",
"fieldConfig": {
"defaults": {
"custom": {}
},
"overrides": []
},
"fill": 1,
"fillGradient": 0,
"gridPos": {
"h": 7,
"w": 12,
"x": 0,
"y": 23
},
"hiddenSeries": false,
"id": 2,
"legend": {
"avg": false,
"current": false,
"max": false,
"min": false,
"show": true,
"total": false,
"values": false
},
"lines": true,
"linewidth": 1,
"links": [],
"nullPointMode": "null",
"options": {
"dataLinks": [
{
"title": "View in Splunk",
"url": "http://localhost:8000/en-US/app/app-docker/docker_overview?form.time.earliest=rt-30m&form.time.latest=rt&form.container_name=${__series.name}"
}
]
},
"percentage": false,
"pointradius": 5,
"points": false,
"renderer": "flot",
"seriesOverrides": [],
"spaceLength": 10,
"stack": true,
"steppedLine": false,
"targets": [
{
"binOptions": {
"bins": null
},
"index": "select index",
"metricAggs": [
{
"alias": "",
"field": "select field",
"func": "avg"
}
],
"namespace": "app-docker",
"options": {
"cont": true,
"limit": null,
"partial": true
},
"query": "|savedsearch memory_max_by_container container_name=*",
"rawQuery": true,
"refId": "A",
"resultFormat": "time_series",
"sourcetype": "select sourcetype",
"splitByFields": [],
"target": "",
"tcOptions": {
"nullstr": "",
"otherstr": "",
"span": "auto",
"usenull": false,
"useother": true
},
"whereClause": {
"agg": "avg",
"condition": "",
"operator": "",
"type": null,
"value": ""
}
}
],
"thresholds": [],
"timeFrom": null,
"timeRegions": [],
"timeShift": null,
"title": "Memory Usage (100%) - Max by container",
"tooltip": {
"shared": true,
"sort": 0,
"value_type": "individual"
},
"type": "graph",
"xaxis": {
"buckets": null,
"mode": "time",
"name": null,
"show": true,
"values": []
},
"yaxes": [
{
"format": "percent",
"label": null,
"logBase": 1,
"max": "100",
"min": "0",
"show": true
},
{
"format": "short",
"label": null,
"logBase": 1,
"max": null,
"min": null,
"show": true
}
],
"yaxis": {
"align": false,
"alignLevel": null
}
},
{
"aliasColors": {},
"bars": false,
"dashLength": 10,
"dashes": false,
"datasource": "Splunk",
"fieldConfig": {
"defaults": {
"custom": {}
},
"overrides": []
},
"fill": 1,
"fillGradient": 0,
"gridPos": {
"h": 7,
"w": 12,
"x": 0,
"y": 30
},
"hiddenSeries": false,
"id": 3,
"legend": {
"avg": false,
"current": false,
"max": false,
"min": false,
"show": true,
"total": false,
"values": false
},
"lines": true,
"linewidth": 1,
"links": [],
"nullPointMode": "null",
"options": {
"dataLinks": [
{
"title": "View in Splunk",
"url": "http://localhost:8000/en-US/app/app-docker/docker_overview?form.time.earliest=rt-30m&form.time.latest=rt&form.container_name=${__series.name}"
}
]
},
"percentage": false,
"pointradius": 5,
"points": false,
"renderer": "flot",
"seriesOverrides": [],
"spaceLength": 10,
"stack": true,
"steppedLine": false,
"targets": [
{
"binOptions": {
"bins": null
},
"index": "select index",
"metricAggs": [
{
"alias": "",
"field": "select field",
"func": "avg"
}
],
"namespace": "app-docker",
"options": {
"cont": true,
"limit": null,
"partial": true
},
"query": "|savedsearch network_input_by_container container_name=*",
"rawQuery": true,
"refId": "A",
"resultFormat": "time_series",
"sourcetype": "select sourcetype",
"splitByFields": [],
"target": "",
"tcOptions": {
"nullstr": "",
"otherstr": "",
"span": "auto",
"usenull": false,
"useother": true
},
"whereClause": {
"agg": "avg",
"condition": "",
"operator": "",
"type": null,
"value": ""
}
}
],
"thresholds": [],
"timeFrom": null,
"timeRegions": [],
"timeShift": null,
"title": "Network Input (Kb)",
"tooltip": {
"shared": true,
"sort": 0,
"value_type": "individual"
},
"type": "graph",
"xaxis": {
"buckets": null,
"mode": "time",
"name": null,
"show": true,
"values": []
},
"yaxes": [
{
"format": "Kbits",
"label": null,
"logBase": 1,
"max": null,
"min": "0",
"show": true
},
{
"format": "short",
"label": null,
"logBase": 1,
"max": null,
"min": null,
"show": true
}
],
"yaxis": {
"align": false,
"alignLevel": null
}
},
{
"aliasColors": {},
"bars": false,
"dashLength": 10,
"dashes": false,
"datasource": "Splunk",
"fieldConfig": {
"defaults": {
"custom": {}
},
"overrides": []
},
"fill": 1,
"fillGradient": 0,
"gridPos": {
"h": 7,
"w": 12,
"x": 0,
"y": 37
},
"hiddenSeries": false,
"id": 5,
"legend": {
"avg": false,
"current": false,
"max": false,
"min": false,
"show": true,
"total": false,
"values": false
},
"lines": true,
"linewidth": 1,
"links": [],
"nullPointMode": "null",
"options": {
"dataLinks": [
{
"title": "View in Splunk",
"url": "http://localhost:8000/en-US/app/app-docker/docker_overview?form.time.earliest=rt-30m&form.time.latest=rt&form.container_name=${__series.name}"
}
]
},
"percentage": false,
"pointradius": 5,
"points": false,
"renderer": "flot",
"seriesOverrides": [],
"spaceLength": 10,
"stack": true,
"steppedLine": false,
"targets": [
{
"binOptions": {
"bins": null
},
"index": "select index",
"metricAggs": [
{
"alias": "",
"field": "select field",
"func": "avg"
}
],
"namespace": "app-docker",
"options": {
"cont": true,
"limit": null,
"partial": true
},
"query": "|savedsearch block_input_by_container container_name=*",
"rawQuery": true,
"refId": "A",
"resultFormat": "time_series",
"sourcetype": "select sourcetype",
"splitByFields": [],
"target": "",
"tcOptions": {
"nullstr": "",
"otherstr": "",
"span": "auto",
"usenull": false,
"useother": true
},
"whereClause": {
"agg": "avg",
"condition": "",
"operator": "",
"type": null,
"value": ""
}
}
],
"thresholds": [],
"timeFrom": null,
"timeRegions": [],
"timeShift": null,
"title": "Block Input (Kb)",
"tooltip": {
"shared": true,
"sort": 0,
"value_type": "individual"
},
"type": "graph",
"xaxis": {
"buckets": null,
"mode": "time",
"name": null,
"show": true,
"values": []
},
"yaxes": [
{
"format": "Kbits",
"label": null,
"logBase": 1,
"max": null,
"min": "0",
"show": true
},
{
"format": "short",
"label": null,
"logBase": 1,
"max": null,
"min": null,
"show": true
}
],
"yaxis": {
"align": false,
"alignLevel": null
}
}
],
"refresh": false,
"schemaVersion": 25,
"style": "dark",
"tags": [],
"templating": {
"list": []
},
"time": {
"from": "2020-07-17T22:24:07.526Z",
"to": "2020-07-17T22:30:04.806Z"
},
"timepicker": {
"refresh_intervals": [
"10s",
"30s",
"1m",
"5m",
"15m",
"30m",
"1h",
"2h",
"1d"
],
"time_options": [
"5m",
"15m",
"1h",
"6h",
"12h",
"24h",
"2d",
"7d",
"30d"
]
},
"timezone": "browser",
"title": "Splunk Docker Stats + ServiceNow",
"uid": "ktis4bnGk",
"version": 2
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment