topic Re: Dynamic hostname in Dashboards & Visualizations

Dynamic hostname

Marco — Wed, 12 Aug 2020 21:55:18 GMT

Hi Splunkers,

I have created a dashboard and I hard coded the hostname. This has become an issue because I have multiple systems and in order to reuse the dashboard I have to manually change the hostname in each of my visualization inside the dash board. Is there a way to make hostname a variable and let the user input which hostname they would like to use?

EX:

List of hostnames:

S0W1SANDBOX

S0W1PRODUCTION

S0W1 WAREHOUSE

host=S0W1PRODUCTION

Thank you!

Re: Dynamic hostname

gcusello — Thu, 13 Aug 2020 09:31:13 GMT

Hi @Marco,

Did you tried to put the hostnames in a lookup and insert a dropdown in dashboard to choose the hostname?

Ciao.

Giuseppe

Re: Dynamic hostname

Marco — Thu, 13 Aug 2020 20:18:11 GMT

Hi @gcusello

No, unfortunately that would not work in this situation because since I eventually plan to put these dashboards into an app. I need to figure out how to make the hostname universal so everyone can you use it without having to change the hostname value.

Thank you Marco

Re: Dynamic hostname

isoutamo — Thu, 13 Aug 2020 20:28:31 GMT

How about to use a savedsearch to update that lookup? Then there will be always needed hostnames, if you have some rules which host you want to add to this dashboard?

r. Ismo

Re: Dynamic hostname

gcusello — Fri, 14 Aug 2020 06:34:52 GMT

Hi @Marco,

have you an hostname related to each user?

if yes, you could read the current user and using the above lookup select the correct hostname.

To read the current user, use this search:

| rest /services/authentication/current-context | rename username AS User_Name | fields User_Name

Ciao.

Giuseppe

Re: Dynamic hostname

Marco — Fri, 14 Aug 2020 15:27:42 GMT

Hi @gcusello ,

No, I have a host name per System. This is the Query i'm issuing is:

host=S0W1 | where like(COMMAND, "MKDIR%")| stats count(COMMAND) AS "Number of times MKDIR Command was issued"

Is there a way to make host name more plug in play friendly because as of right now if I want to run the reports in both systems I have to change the host name manually.

EX:

host=S0W1 | where like(COMMAND, "MKDIR%")| stats count(COMMAND) AS "Number of times MKDIR Command was issued"

host=S0W1.PRODUCTION | where like(COMMAND, "MKDIR%")| stats count(COMMAND) AS "Number of times MKDIR Command was issued"

Marco_4-1597416602818.png

Re: Dynamic hostname

Marco — Fri, 14 Aug 2020 18:44:59 GMT

Came up with a temporary solution, I set the host value equal to a wild card.

Ex: host = *

It's doing the job thanks guys!