topic Re: Dashboard help in Dashboards & Visualizations

Dashboard help

mhorn — Fri, 06 Dec 2013 15:01:29 GMT

Hi I'm trying to create a custom dashboard which list the companies and products we have running on our servers. To define the term company i setup a field extraction -> transform to look at a specific folder on each server. i have the logs for each company/product writing to their specific folder (c:\logs\ABC Company\Product). I've tried using source, field, sourcetype=company and i can't get it to list out the companies. Anybody have any suggestions? Also i'm using a basic xml dashboard design since programming is not my forte.

Thank you

Re: Dashboard help

lukejadamec — Fri, 06 Dec 2013 15:15:30 GMT

First you need to create a search that pulls the data you want.
But, even before that you need to have the data in Splunk to search. It sounds like you don't have the data. Do you have the data indexed?

Re: Dashboard help

mhorn — Fri, 06 Dec 2013 15:17:00 GMT

yup...it's in there. I have about 5 years of data. I tried to post a pic, but i don't have enough points 😞

Re: Dashboard help

lukejadamec — Fri, 06 Dec 2013 15:27:39 GMT

Why don't you use the built in dashboard creator? From the search page select Dashboards & Views > Create Dashboard.
Set Edit to ON, Add a Panel, and paste your working search into as an Inline Search.

Re: Dashboard help

mhorn — Fri, 06 Dec 2013 16:37:51 GMT

i've tried that but i can't get the search to just list the companies out individually and make them hyperlinked. If I do company=”*”, I just get 100's of log pages with the most active company at the top. I might have to go 50 pages deep to find the company I actually want.

I wanted the company names listed out like the host/servers are on the summary dashboard. you click on the company and you get all the logs. wish i would post a pic 😞

Re: Dashboard help

somesoni2 — Fri, 06 Dec 2013 19:38:46 GMT

Try using this in your dashboard xml (Splunk 6 version)

<dashboard>
  <label>Summary Dashboard</label>
  <description></description>
  <row>
    <table>
      <title>Select Company</title>
      <searchString>
        sourcetype=company | stats count by company| fields - count
      </searchString>
      <earliestTime>0</earliestTime>
      <latestTime>now</latestTime>
      <option name="wrap">true</option>
      <option name="drilldown">row</option>
      <option name="count">10</option>
      </table>
  </row>
</dashboard>

This dashboard create a table with unique list of companies. Increate the "count" option value as per your need. It by default drilldowns to Splunk Search app with selected company name, with search query like below.

sourcetype=company company="Your selected company name"

Re: Dashboard help

mhorn — Fri, 06 Dec 2013 20:37:57 GMT

unfortunately sourcetype=company nor source=company return any results. really confusing!!

Re: Dashboard help

somesoni2 — Sat, 07 Dec 2013 00:54:42 GMT

This just an example query. replace it with index/source/sourcetype of yours which has company data.