diff --git a/dashboards/dashboard.xml b/dashboards/dashboard.xml new file mode 100644 index 00000000..12bcc296 --- /dev/null +++ b/dashboards/dashboard.xml @@ -0,0 +1,269 @@ +
+ +
+ + + Event count + + + index=* sourcetype="cf:*" | timechart span=10m count + -24h + + 5m + delay + + + + + + + + + + + Distributions of events by index + + + index=* sourcetype="cf:*" | stats count by index + 0 + 1 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Total number of PCF events by index + + + index=* sourcetype="cf:*" | chart sparkline(count) AS "Indexes Trend" count AS Total BY index + 0 + + 1 + + + + + + + + + +
+ + + + + Events by sources + + + + -24h@h + now + + + + Events by source + + index=* sourcetype="cf:*" | top source + $source_time_range.earliest$ + $source_time_range.latest$ + + + + + + + + + + + Events by sourcetype + + + + -24h@h + now + + + + Events by sourcetype + + index=* sourcetype="cf:*" | top sourcetype + $source_time_range.earliest$ + $source_time_range.latest$ + + + + + + + + + + + + + Internal Splunk errors count + + + index=_internal component=HttpInputDataHandler (log_level="WARN" OR log_level="ERROR") | timechart span=10m count + -24h + + 5m + delay + + + + + + + + Internal Splunk errors sample + + + index=_internal component=HttpInputDataHandler (log_level="WARN" OR log_level="ERROR") | table name,parsing_err + 0 + 1 + + + + + +
+ + + + + + Nozzle errors count + + + index=* sourcetype="cf:splunknozzle" message="*error*" | timechart span=10m count + -24h + + 5m + delay + + + + + + + + Nozzle errors sample + + + index=* sourcetype="cf:splunknozzle" message="*error*" | table source,logger_source,message + 0 + 1 + + + + + +
+ + + + + + Nozzle CPU usage + + + | mstats avg("nozzle.usage.cpu") prestats=true WHERE "index"="pcf_metrics" span=10s | timechart avg("nozzle.usage.cpu") AS Avg span=10s | fields - _span* + -1h + + 5m + delay + + + + + + + + + + + Nozzle RAM usage + + + | mstats avg("nozzle.usage.ram") prestats=true WHERE "index"="pcf_metrics" span=10s | timechart avg("nozzle.usage.ram") AS Avg span=10s | fields - _span* + -1h + + 5m + delay + + + + + + + + + + + Nozzle events sent + + + | mstats rate_avg("firehose.events.received.count") as "Rate (Avg) /s" chart=true WHERE "index"="pcf_metrics" span=30s | fields - _span* + -1h + + 5m + delay + + + + + + + + Nozzle events dropped + + + | mstats rate_avg("firehose.events.dropped.count") as "Rate (Avg) /s" chart=true WHERE "index"="pcf_metrics" span=30s | fields - _span* + -1h + + 5m + delay + + + + + + + + + +
\ No newline at end of file