All Apps and Add-ons

dashboards not populated when new index defined

Esky73
Builder

I have created a new index (new_relic) and added the account input settings - the new_relic index is populated with my application
(just the one currently) however the application dashboard does not work.

If i then use the 'main' index as per the setup screenshots - the dashboards work with the same data thats alos populating the new_relic index

how to populate the dashboards using the new_relic index created.

Have checked permissions etc, new index is in context of new relic TA, the new_relic index correctly uses the newrelic:applications sourcetype.

The macro 'getsources' runs ok but only uses the 'main' index

thx

1 Solution

woodcock
Esteemed Legend

I believe you are supposed to modify the getsources macro and change main to new_relic and then everything should work.

View solution in original post

woodcock
Esteemed Legend

I believe you are supposed to modify the getsources macro and change main to new_relic and then everything should work.

Esky73
Builder

Thanks mate - that was it.

The 'main' index wasn't specified in the macro so thats what was throwing me - so i guess it just default there.

So i changed the 'get_sources(4)' macro from:

(sourcetype=$new_sourcetype$ source=$new_source$) OR (sourcetype=newrelic_account source="$old_source$" account_id=$account_id$ ) | eval new_source = if(sourcetype="newrelic_account",input_name +":" + account_id,source), account_id = if(sourcetype="newrelic_account",account_id, rtrim(new_source,":") )

to

index=new_relic (sourcetype=$new_sourcetype$ source=$new_source$) OR (sourcetype=newrelic_account source="$old_source$" account_id=$account_id$ ) | eval new_source = if(sourcetype="newrelic_account",input_name +":" + account_id,source), account_id = if(sourcetype="newrelic_account",account_id, rtrim(new_source,":") )

All good.

0 Karma

remoharish
Engager

Thanks all, It worked for me also, Big thanks to both.

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...