topic Re: Sample Dashboard ideas in Dashboards & Visualizations

Sample Dashboard ideas

splunklearner — Tue, 28 Jan 2025 10:34:38 GMT

Hello all,

I have an ask to create a sample dashboard with the data present. Hence I have created following panels with dropdowns available:

Total Traffic vs Attack Traffic - | stats count as "Total Traffic" count(eval(isnotnull(attack_type))) as "Attack Traffic".
Top 10 Hostnames / FQDN Targeted - |stats count by fqdn
No of Error logs - |search severity = Error |stats count
No of Critical logs - |search severity = Critical |stats count
Attack Classification by % - (Num of Attacks) - |top limit=10 attack_type
Top 10 IP Addresses - | top ip_client limit=10
Daily Attack Trend - |timechart count(attack_type) as count span=1d
Weekly Attack Trend - |timechart count(attack_type) as count span=1w
Status Codes Trend - |stats count by response_code
HTTP Method Used - |stats count by method
Log Details - |table _time, ip_client, method, policy_name, response_code, support_id, severity, violations, sub_violations, violation_rating, uri

All searches followed by base search.

Please let me know if any panel needs to be modified or more detailed than this basic ones. Also please suggest if any new panel can be added. Please suggest any drilldowns as well.

Re: Sample Dashboard ideas

richgalloway — Tue, 28 Jan 2025 13:04:14 GMT

Please let me know if any panel needs to be modified or more detailed than this basic ones. Also please suggest if any new panel can be added. Please suggest any drilldowns as well.

These are questions only your stakeholders can answer. If the proposed panels answer the questions they have or solve their problems then modifications may not be necessary.

Re: Sample Dashboard ideas

PickleRick — Tue, 28 Jan 2025 13:22:25 GMT

The main question is what the dashboard is supposed to be for.

Are you solving some problem from within your organization? In such case - as @richgalloway pointed out - you should have requirements for this dashboard.

Are you preparing a PoC/PoV as a partner? Consult partner portal resources for existing demo resources.

Are you looking to expand existing Splunk infrastructure within your company to different divisions and use cases? Consult potential stakeholders and check what would be their expectations on the product and try to make something targeting their needs.

The general answer is "depends on what you have and what you need".

Re: Sample Dashboard ideas

splunklearner — Tue, 28 Jan 2025 15:26:08 GMT

Actually it is a new project and creating sample dashboards for application teams. Just want to check any use cases I can get related to my fields given above...

Re: Sample Dashboard ideas

bowesmana — Tue, 28 Jan 2025 23:17:01 GMT

To go slightly tangential to your post, you refer to base searches. Note that a base search that does NOT do aggregation is a bad use of a base search, so if you are just doing

index=xxx | fields *

in your base search and not doing a transforming command, that is not a good example to be showing in an example dashboard. It will often perform worse than one using a transforming command, but also has significant limitations in that it can only hold a limited set of results.

See this

https://docs.splunk.com/Documentation/Splunk/9.4.0/Viz/Savedsearches#Post-process_searches_2

Re: Sample Dashboard ideas

ITWhisperer — Wed, 29 Jan 2025 09:23:01 GMT

It is the same answer as @richgalloway already gave - check with your stakeholders as to what they want. There is little point building a dashboard that nobody is going to use! Start small with just one or two panels and see if they find it useful and ask them how it might be changed and what else they might want to see.

Re: Sample Dashboard ideas

maroond — Thu, 19 Mar 2026 23:12:31 GMT

for failed auth monitoring i usually start with three panels: failed logins by hour (timechart), top source IPs (stats count by src_ip), and top targeted users (stats count by user). if you're using CIM normalized fields its pretty straightforward. layout wise i do the timechart full width on top, then the two tables side by side below it

topic Re: Sample Dashboard ideas in Dashboards & Visualizations

Sample Dashboard ideas

Total Traffic vs Attack Traffic - | stats count as "Total Traffic" count(eval(isnotnull(attack_type))) as "Attack Traffic".

Re: Sample Dashboard ideas

Re: Sample Dashboard ideas

Re: Sample Dashboard ideas

Re: Sample Dashboard ideas

Re: Sample Dashboard ideas

Re: Sample Dashboard ideas