Dashboards & Visualizations

Adding a Splunk Search from Another Domain to a Dashboard

Path Finder

Got an interesting dilemma. I work for a large worldwide company. Each site around the world has their own unique set of indexers/clustered search peers for their own domain. I.e. https://lesplunk.lehi.micron.com:8000/ - for the Lehi, UT, USA site.

However, we have some ingestion which is queried by a centralized/worldwide indexer/search head cluster.

I would like to create a dashboard that can run a set of searches local to my domain (Lehi Splunk environment) but also display a single report from a search that must be performed on the worldwide domain (ww Splunk environment).

I’ve tried to use iframe in a panel to get the correct report to show, but I may be messing this one up.  The biggest issue I have appears to be regarding the access to the web sites: [web address] refused to connect.  Even tried to iframe in www.google.com to see if I could get it to display.

I used this code snippet from another community page reference to test out the iframe feature:
       <h2>Example iframe of a dashboard</h2>
        <p>Uses display controls via the http get param</p>
          <![CDATA[<iframe src="/app/simple_xml_examples/simple_display_controls_example?hideChrome=true&hideEdit=true">]]>
        <iframe src="/app/simple_xml_examples/simple_display_controls_example?hideChrome=true&amp;hideEdit=true" width="100%" height="400" border="0" frameborder="0"/>

I know that each instance of Splunk at each of the sites has its own set of login credentials, so I assume that the issue is related to the Lehi Splunk credentials being passed to run the report at the ww Splunk site.

I found this article "Search across multiple indexer clusters" from docs.splunk.com: https://docs.splunk.com/Documentation/Splunk/8.1.0/Indexer/Configuremulti-clustersearch - This one says that we could setup our search heads to hit the ww Splunk ingested data, but I think it would apply to ALL sarches from the Lehi Splunk environment and would apply to ALL data that has been ingested in the WW Splunk environment (which I do not want).  If this is not how this works, please correct my ignorance.  Or if there is  way to setup a single dashboard to work in this fashion, please share.

Using the help ffrom this community question "Feature Request: How to embed a dashboard (not a report) that is updated every hour in a webpage?" (https://community.splunk.com/t5/Dashboards-Visualizations/Feature-Request-How-to-embed-a-dashboard-n...), I tried this:

<iframe src="https://wwsplunk-vip/en-US/app/search/orion_client_percent_availability?username=viewonlyuser&amp;password=viewonly&amp;return_to=/app/MES/orion_clone" frameborder="no" scrolling="no" width="1200" height="500" title="ORION Client Percent Availability" ></iframe>

Still nothing, but I did not get the "[web address] refused to connect" error, so I think this might be closer.

I've read through quite a few community pages looking for answers, but if this sounds familiar or you have a page I may have missed, simply direct me to the link. Any suggestions for what to try next?  Anyone ever had a similar issue?  Any simpler method to insert a report/dashboard from one Splunk server into a dashboard panel of another Splunk server (not in the same cluster)?

If I can provide any more details to help make this clearer, I will happily reply with additional details.

Labels (1)
Tags (3)
0 Karma

Path Finder

No takers on this question, huh?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...