Dashboards & Visualizations

how to build a simple dashboard using index and source

tkrprakash
Loves-to-Learn

how to build a simple dashboard using index and source ; and modify the search for various scenarios ,

I have an index ; I have a source

how can I list all fields in my source and index and make us of them with simple visualizations

please help

Tags (1)
0 Karma
1 Solution

DalJeanis
Legend

Before you make the dashboard, you need to play around and get comfortable with the search box.

Enter this...

index=foo | head 5

Since there are only 5 records, every field in any of them will appear in the "interesting fields" list to the left. (Being on one record is 20%, which makes it "interesting".) Look at the field names, and click on them to see what kind of values they hold.

You can also do this to get a list of the field names output from a search...

index=foo | head 10 | fieldsummary

That will give you a table displaying various information about non-internal fields. (Internal fields, those beginning with underscore, you don't want to mess with, with the possible exception of _time.)

Play with these commands first - eval, stats, eventstats, chart, timechart.

For every one of those commands but eval, play with these aggregation functions first - count(), sum(), avg(), min(), max(), first(), last(), earliest(), latest(), stdev()

Once you feel comfortable with what those all do, then come back and ask about visualizations.


Updated to use the more modern fieldsummary command.

View solution in original post

0 Karma

niketn
Legend

You can go through Splunk search tutorial, following topic talks about creation of dashboards and next step.
http://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/Createnewdashboard

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

DalJeanis
Legend

Before you make the dashboard, you need to play around and get comfortable with the search box.

Enter this...

index=foo | head 5

Since there are only 5 records, every field in any of them will appear in the "interesting fields" list to the left. (Being on one record is 20%, which makes it "interesting".) Look at the field names, and click on them to see what kind of values they hold.

You can also do this to get a list of the field names output from a search...

index=foo | head 10 | fieldsummary

That will give you a table displaying various information about non-internal fields. (Internal fields, those beginning with underscore, you don't want to mess with, with the possible exception of _time.)

Play with these commands first - eval, stats, eventstats, chart, timechart.

For every one of those commands but eval, play with these aggregation functions first - count(), sum(), avg(), min(), max(), first(), last(), earliest(), latest(), stdev()

Once you feel comfortable with what those all do, then come back and ask about visualizations.


Updated to use the more modern fieldsummary command.

0 Karma

tkrprakash
Loves-to-Learn

Thank you very much Sir , let me start exploring , the first command works , the second command the field value and fieldname should be selected as per the event and output generated in command one above right ?

0 Karma

DalJeanis
Legend

@tkrprakash - no, I had an error in my aircode. I've updated the code to use the more modern fieldsummary, which is a much better resource for you at this point. Try it and you'll see what I mean.

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...