Dashboards & Visualizations

how to build a simple dashboard using index and source

tkrprakash
Loves-to-Learn

how to build a simple dashboard using index and source ; and modify the search for various scenarios ,

I have an index ; I have a source

how can I list all fields in my source and index and make us of them with simple visualizations

please help

Tags (1)
0 Karma
1 Solution

DalJeanis
Legend

Before you make the dashboard, you need to play around and get comfortable with the search box.

Enter this...

index=foo | head 5

Since there are only 5 records, every field in any of them will appear in the "interesting fields" list to the left. (Being on one record is 20%, which makes it "interesting".) Look at the field names, and click on them to see what kind of values they hold.

You can also do this to get a list of the field names output from a search...

index=foo | head 10 | fieldsummary

That will give you a table displaying various information about non-internal fields. (Internal fields, those beginning with underscore, you don't want to mess with, with the possible exception of _time.)

Play with these commands first - eval, stats, eventstats, chart, timechart.

For every one of those commands but eval, play with these aggregation functions first - count(), sum(), avg(), min(), max(), first(), last(), earliest(), latest(), stdev()

Once you feel comfortable with what those all do, then come back and ask about visualizations.


Updated to use the more modern fieldsummary command.

View solution in original post

0 Karma

niketn
Legend

You can go through Splunk search tutorial, following topic talks about creation of dashboards and next step.
http://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/Createnewdashboard

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

DalJeanis
Legend

Before you make the dashboard, you need to play around and get comfortable with the search box.

Enter this...

index=foo | head 5

Since there are only 5 records, every field in any of them will appear in the "interesting fields" list to the left. (Being on one record is 20%, which makes it "interesting".) Look at the field names, and click on them to see what kind of values they hold.

You can also do this to get a list of the field names output from a search...

index=foo | head 10 | fieldsummary

That will give you a table displaying various information about non-internal fields. (Internal fields, those beginning with underscore, you don't want to mess with, with the possible exception of _time.)

Play with these commands first - eval, stats, eventstats, chart, timechart.

For every one of those commands but eval, play with these aggregation functions first - count(), sum(), avg(), min(), max(), first(), last(), earliest(), latest(), stdev()

Once you feel comfortable with what those all do, then come back and ask about visualizations.


Updated to use the more modern fieldsummary command.

0 Karma

tkrprakash
Loves-to-Learn

Thank you very much Sir , let me start exploring , the first command works , the second command the field value and fieldname should be selected as per the event and output generated in command one above right ?

0 Karma

DalJeanis
Legend

@tkrprakash - no, I had an error in my aircode. I've updated the code to use the more modern fieldsummary, which is a much better resource for you at this point. Try it and you'll see what I mean.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...