Help with Dashboard creation

splunk6 — Tue, 07 May 2024 18:28:39 GMT

Hi,

I have a raw data as below, with the fields "ID, Date, Level, Logger, Message which needs to be dsiplayed in a dashboard.

index="wireless_retail" source="CPS.cpsLog" Level="ERROR", Logger="Utils.Helpers.LogHelper". Can someone help me with this dashboard creation for this

ID="39090", Date="2024-05-07 14:12:53.313", Thread="4", Level="ERROR", Logger=".Utils.Helpers.LogHelper", Message="UserName: abc Location: Sales Channel: GW_STORE Error in Path: /pap/getcpsinput Raw Url: /pap/getcpsinput User Name: Error: System.Data.Entity.Core.EntityException: An error occurred while starting a transaction on the provider connection. See the inner exception for details. ---> System.Data.SqlClient.SqlException: Execution Timeout Expired. The timeout period elapsed prior to completion of the operation or the server is not responding. ---> System.ComponentModel.Win32Exception: The wait operation timed out --- End of inner exception stack trace --- at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction) at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj, Boolean callerHasConnectionLock, Boolean asyncClose) at System.Data.SqlClient.TdsParserStateObject.ReadSniError(TdsParserStateObject stateObj, UInt32 error) at System.Data.SqlClient.TdsParserStateObject.ReadSniSyncOverAsync() at System.Data.SqlClient.TdsParserStateObject.TryReadNetworkPacket() at System.Data.SqlClient.TdsParserStateObject.TryPrepareBuffer() at System.Data.SqlClient.TdsParserStateObject.TryReadByte(Byte& value) at System.Data.SqlClient.TdsParser.TryRun(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj, Boolean& dataReady)

Re: Help with Dashboard creation

deepakc — Tue, 07 May 2024 18:59:22 GMT

The first thing about dashboards is that you should create draw out a design, what data, fields, and what kind of layout, table, chart, timechart, forms etc.

Then create a prototype dashboard based on that and refine it until you have the results.

Why not try and create the dashboards, have a look here there a several examples

https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchTutorial/Createnewdashboard

Even better if you run through this tutorial - by the end of the week you should be able to create some of you own dashboard.

https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/SearchTutorial/WelcometotheSearchTutorial

These are very simple examples of different ways to present your data and put them into a dashboard.

This shows just a table for the fields of interest to you:.

index="wireless_retail" source="CPS.cpsLog" | fields ID, Date, Level, Logger, Message | table Date, ID, Level, Message

This shows how many events by Level field

index="wireless_retail" source="CPS.cpsLog" | fields ID, Date, Level, Logger, Message | stats count by Level, ID, message

This shows using time period for Level by ID

index="wireless_retail" source="CPS.cpsLog" | fields ID, _time, Date, Level, Logger, Message | timechart span=1h count by Level by ID

You can also download this app and use the many great examples here
https://splunkbase.splunk.com/app/1603

topic Help with Dashboard creation in Splunk Enterprise

Help with Dashboard creation

Re: Help with Dashboard creation