Is there a way to create a dashboard to show hosts over time?

Query Help

For example, we're trying to hunt down our last remaining Windows 7 hosts and we would like to track that over time in a dashboard. It's easy enough to do track something over time with custom filters in Spotlight and then making a dashboard based upon that custom filter but I can't see a way to do it within Discover or Host Mgmt.

Has anyone done this successfully that might be able to comment?

Posted Nov 14, 2022, 2:28 PM UTC

117
Andrew-CSCS ENGINEER•

Hi there. A few options, you can use Host Management and just filter by "Last Seen."

https://imgur.com/a/ATO4wgt

Or you can make a custom dashboard and use Discover data:

https://imgur.com/a/YeRII8a

Mine is filtered by week, but you can change it to month as well.

I hope that helps.

3
pepapiOP•

I had previously setup that 2nd example and it's close to what I was hoping for, it will have to do. The drawback seems to be the last seen part, was hoping for a more real-time look at things. Thanks for taking the time to respond.

1
Andrew-CSCS ENGINEER•

How real time are you looking to get? We can setup a query to count these systems, but the narrower the bucket the more variability you have — example: if I'm counting things in 15 minute buckets, and my Windows 7 laptop has been closed for 8 hours, you may end up with skewed data.

1
pepapiOP•

Yes I see what you mean. My end goal is to have an accurate monthly number to produce for mgmt. Will your previously shown graph be ok for that?

1
Andrew-CSCS ENGINEER•

Yup! You can use Discover data and do weekly and/or monthly. That's likely the best.

1
BigOwlCriesForLogs•

Are you using LogScale?

2
pepapiOP•

No, we don't currently have that module.

1