topic Re: dashboard creation in Dashboards & Visualizations

dashboard creation

sushmitha_mj — Fri, 27 Mar 2015 22:05:01 GMT

I created a deployment app to make a forwarder pick data from a location and index it lets say index A.
Then I created another app whose index is index A , so I can use this app for data display.

Now I see data in the index, and search it using the"index=A" command.
But is this the best way to do it?
Should I not be able to see the data on the app's data summary screen?
Can I build dashboards by using "index=A" as a part of the query?

Re: dashboard creation

masonmorales — Fri, 27 Mar 2015 23:23:01 GMT

Can I build dashboards by using "index=A" as a part of the query?

Yes.

Now I see data in the index, and search it using the"index=A" command. But is this the best way to do it?

Yes, it is, but as you continue to add different kinds of data you will also want to specify in your searches: index=a sourcetype=b source=c host=d when possible.

Should I not be able to see the data on the app's data summary screen?

Correct. You need to execute a search (or build a dashboard with panels that have searches) in order to see your data. The summary screen just lets you know that data is being indexed.

Re: dashboard creation

marcoscala — Sat, 28 Mar 2015 12:53:16 GMT

In the Data Summary you see events from your (the user your using) default indexes. If index A is not among your default indexes, you won't see the number of events in the summary data.
To add it as default index, go to Settings - user management and change the role setting the user belongs to. that apples also for Admin user.

Re: dashboard creation

sushmitha_mj — Mon, 30 Mar 2015 14:05:11 GMT

@marcoscala
I do not find user management under my settings and I also, do not find the index name anywhere in the data summary. I only find hosts, sources, sourcetype. where should I look for the index?

Re: dashboard creation

sushmitha_mj — Mon, 30 Mar 2015 18:49:01 GMT

@masonmorales

I did perform a search. BuT I still cannot see the data in the summary. The problem is, it takes a lot of time to load the data (I have millions of records), each time I execute the search.

How do I get over this problem?

Re: dashboard creation

sushmitha_mj — Mon, 30 Mar 2015 20:59:03 GMT

It worked...................... 🙂
Thanks...

Re: dashboard creation

sushmitha_mj — Mon, 30 Mar 2015 20:59:26 GMT

It worked... thanks...... 🙂

Re: dashboard creation

masonmorales — Mon, 30 Mar 2015 21:03:11 GMT

No problem. In regards to improving load time, you may to take a look at the resources in this post: http://answers.splunk.com/answers/224261/does-accelerated-searching-cache-data-so-its-faste.html