https://community.splunk.com/t5/Dashboards-Visualizations/What-is-the-best-way-to-Identify-data-by-application-Dashboard/m-p/422255#M42496 <P>Currently, we have indexes configured for prod, qa and dev. However, we have no way to filter data by the application/service other than using the source type and/or hostname. </P> <P>Is there a way to tag the data by application rather than creating manual queries within a dashboard?</P> <P>Many thanks in advance. </P> Tue, 05 Mar 2019 16:00:04 GMT bclaydonlight 2019-03-05T16:00:04Z https://community.splunk.com/t5/Dashboards-Visualizations/What-is-the-best-way-to-Identify-data-by-application-Dashboard/m-p/422255#M42496 <P>Currently, we have indexes configured for prod, qa and dev. However, we have no way to filter data by the application/service other than using the source type and/or hostname. </P> <P>Is there a way to tag the data by application rather than creating manual queries within a dashboard?</P> <P>Many thanks in advance. </P> Tue, 05 Mar 2019 16:00:04 GMT https://community.splunk.com/t5/Dashboards-Visualizations/What-is-the-best-way-to-Identify-data-by-application-Dashboard/m-p/422255#M42496 bclaydonlight 2019-03-05T16:00:04Z https://community.splunk.com/t5/Dashboards-Visualizations/What-is-the-best-way-to-Identify-data-by-application-Dashboard/m-p/422256#M42497 <P>well, you did mention <CODE>tag</CODE> in your question, maybe give it a shot:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.2.4/Knowledge/Abouttagsandaliases">https://docs.splunk.com/Documentation/Splunk/7.2.4/Knowledge/Abouttagsandaliases</A></P> Tue, 05 Mar 2019 18:39:27 GMT https://community.splunk.com/t5/Dashboards-Visualizations/What-is-the-best-way-to-Identify-data-by-application-Dashboard/m-p/422256#M42497 adonio 2019-03-05T18:39:27Z https://community.splunk.com/t5/Dashboards-Visualizations/What-is-the-best-way-to-Identify-data-by-application-Dashboard/m-p/422257#M42498 <P>As @adonio mentioned, tagging is a valid option. You could also create a lookup file with a mapping of sourcetypes to applications. It may be easier to manage this if you have the Lookup File Editor app installed.</P> <P>Lookups: <A href="https://docs.splunk.com/Documentation/Splunk/7.2.4/Knowledge/ConfigureCSVlookups">https://docs.splunk.com/Documentation/Splunk/7.2.4/Knowledge/ConfigureCSVlookups</A><BR /> Lookup File Editor: <A href="https://splunkbase.splunk.com/app/1724/">https://splunkbase.splunk.com/app/1724/</A></P> Tue, 05 Mar 2019 19:46:19 GMT https://community.splunk.com/t5/Dashboards-Visualizations/What-is-the-best-way-to-Identify-data-by-application-Dashboard/m-p/422257#M42498 pkeenan87 2019-03-05T19:46:19Z