All Apps and Add-ons

dashboards not populated when new index defined

Esky73
Builder

I have created a new index (new_relic) and added the account input settings - the new_relic index is populated with my application
(just the one currently) however the application dashboard does not work.

If i then use the 'main' index as per the setup screenshots - the dashboards work with the same data thats alos populating the new_relic index

how to populate the dashboards using the new_relic index created.

Have checked permissions etc, new index is in context of new relic TA, the new_relic index correctly uses the newrelic:applications sourcetype.

The macro 'getsources' runs ok but only uses the 'main' index

thx

1 Solution

woodcock
Esteemed Legend

I believe you are supposed to modify the getsources macro and change main to new_relic and then everything should work.

View solution in original post

woodcock
Esteemed Legend

I believe you are supposed to modify the getsources macro and change main to new_relic and then everything should work.

Esky73
Builder

Thanks mate - that was it.

The 'main' index wasn't specified in the macro so thats what was throwing me - so i guess it just default there.

So i changed the 'get_sources(4)' macro from:

(sourcetype=$new_sourcetype$ source=$new_source$) OR (sourcetype=newrelic_account source="$old_source$" account_id=$account_id$ ) | eval new_source = if(sourcetype="newrelic_account",input_name +":" + account_id,source), account_id = if(sourcetype="newrelic_account",account_id, rtrim(new_source,":") )

to

index=new_relic (sourcetype=$new_sourcetype$ source=$new_source$) OR (sourcetype=newrelic_account source="$old_source$" account_id=$account_id$ ) | eval new_source = if(sourcetype="newrelic_account",input_name +":" + account_id,source), account_id = if(sourcetype="newrelic_account",account_id, rtrim(new_source,":") )

All good.

0 Karma

remoharish
Engager

Thanks all, It worked for me also, Big thanks to both.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...