topic How to get Server name based dashboard in Dashboards & Visualizations

How to get Server name based dashboard

digitalrg — Fri, 01 Aug 2014 09:35:48 GMT

Hello,

I am forwarding a log file with some data in it and using below search string:
sourcetype=dhap source="/var/log/dhap-log" "WAIT"
Once I run this search, under Hosts field I get 2 entries for the servers from where i am getting the results. I want to save this search to a Dashboard panel where it should give me a drop-down menu for the entries from the "host" field.

Please help me on this.

Thanks,
Raghav

Re: How to get Server name based dashboard

tom_frotscher — Fri, 01 Aug 2014 12:51:13 GMT

What version of Splunk do you use?

Re: How to get Server name based dashboard

somesoni2 — Fri, 01 Aug 2014 14:16:01 GMT

Give this a try. (simple xml form with host dropdown)

<form>
  <label>Dynamic Host</label>
  <fieldset autoRun="true" >
      <input type="time" />
    <input type="dropdown" token="sourcetype">
      <label>Host</label>
      <choice value="*">All</choice>
      <default>*</default>
      <populatingSearch fieldForValue="host" fieldForLabel="host">
        <![CDATA[| metasearch sourcetype=dhap source="/var/log/dhap-log" | stats count by host | table host ]]>
      </populatingSearch>
    </input>
  </fieldset>
  <row>
    <event>
      <title>Top 5 source</title>
      <searchString>sourcetype=dhap source="/var/log/dhap-log" "WAIT" host="$host$" </searchString>      
      <option name="count">10</option>
    </event>
  </row>
</form>

Answer no 2: with 2 dropdown source and sourcetype for base search index=main.

<form>
  <label>Dynamic Host</label>
  <fieldset autoRun="true" >
      <input type="time" />
    <input type="dropdown" token="sourcetype">
      <label>SourceType</label>
      <choice value="*">All</choice>
      <default>*</default>
      <populatingSearch fieldForValue="sourcetype" fieldForLabel="sourcetype">
        <![CDATA[| metasearch index=main | stats count by sourcetype ]]>
      </populatingSearch>
    </input>
<input type="dropdown" token="source">
      <label>Source</label>
      <choice value="*">All</choice>
      <default>*</default>
      <populatingSearch fieldForValue="source" fieldForLabel="source">
        <![CDATA[| metasearch index=main | stats count by source ]]>
      </populatingSearch>
    </input>
  </fieldset>
  <row>
    <event>
      <title>Top 5 source</title>
      <searchString>index=main sourcetype="$sourcetype$" source="$source$" | rest of your search </searchString>      
      <option name="count">10</option>
    </event>
  </row>
</form>

Re: How to get Server name based dashboard

digitalrg — Fri, 01 Aug 2014 15:50:16 GMT

Thanks somesoni2.
This works well after changing token="host"
However can you please tell me if the same thing i want to have it only as a Dashboard panel how can i modify this?

Thanks in advance.

Re: How to get Server name based dashboard

rahulroy_splunk — Fri, 01 Aug 2014 19:58:39 GMT

If you already have an existing dashboard(or rather form), you can copy the "" to

tag of that dashboard and copy "
...
" to section after

. I hope this is what you're asking.

Re: How to get Server name based dashboard

digitalrg — Mon, 11 Aug 2014 09:51:47 GMT

Thanks Rahul Roy.
One more query I have.
Lets say I want to get a 2 dropdowns like "Source" and "Sourcetype" with the basic search as index=main
How do I do it?