Dashboards & Visualizations

Adding a Splunk Search from Another Domain to a Dashboard

Path Finder

Got an interesting dilemma. I work for a large worldwide company. Each site around the world has their own unique set of indexers/clustered search peers for their own domain. I.e. https://lesplunk.lehi.micron.com:8000/ - for the Lehi, UT, USA site.

However, we have some ingestion which is queried by a centralized/worldwide indexer/search head cluster.

I would like to create a dashboard that can run a set of searches local to my domain (Lehi Splunk environment) but also display a single report from a search that must be performed on the worldwide domain (ww Splunk environment).

I’ve tried to use iframe in a panel to get the correct report to show, but I may be messing this one up.  The biggest issue I have appears to be regarding the access to the web sites: [web address] refused to connect.  Even tried to iframe in www.google.com to see if I could get it to display.

I used this code snippet from another community page reference to test out the iframe feature:
       <h2>Example iframe of a dashboard</h2>
        <p>Uses display controls via the http get param</p>
          <![CDATA[<iframe src="/app/simple_xml_examples/simple_display_controls_example?hideChrome=true&hideEdit=true">]]>
        <iframe src="/app/simple_xml_examples/simple_display_controls_example?hideChrome=true&amp;hideEdit=true" width="100%" height="400" border="0" frameborder="0"/>

I know that each instance of Splunk at each of the sites has its own set of login credentials, so I assume that the issue is related to the Lehi Splunk credentials being passed to run the report at the ww Splunk site.

I found this article "Search across multiple indexer clusters" from docs.splunk.com: https://docs.splunk.com/Documentation/Splunk/8.1.0/Indexer/Configuremulti-clustersearch - This one says that we could setup our search heads to hit the ww Splunk ingested data, but I think it would apply to ALL sarches from the Lehi Splunk environment and would apply to ALL data that has been ingested in the WW Splunk environment (which I do not want).  If this is not how this works, please correct my ignorance.  Or if there is  way to setup a single dashboard to work in this fashion, please share.

Using the help ffrom this community question "Feature Request: How to embed a dashboard (not a report) that is updated every hour in a webpage?" (https://community.splunk.com/t5/Dashboards-Visualizations/Feature-Request-How-to-embed-a-dashboard-n...), I tried this:

<iframe src="https://wwsplunk-vip/en-US/app/search/orion_client_percent_availability?username=viewonlyuser&amp;password=viewonly&amp;return_to=/app/MES/orion_clone" frameborder="no" scrolling="no" width="1200" height="500" title="ORION Client Percent Availability" ></iframe>

Still nothing, but I did not get the "[web address] refused to connect" error, so I think this might be closer.

I've read through quite a few community pages looking for answers, but if this sounds familiar or you have a page I may have missed, simply direct me to the link. Any suggestions for what to try next?  Anyone ever had a similar issue?  Any simpler method to insert a report/dashboard from one Splunk server into a dashboard panel of another Splunk server (not in the same cluster)?

If I can provide any more details to help make this clearer, I will happily reply with additional details.

Labels (1)
Tags (3)
0 Karma

Path Finder

No takers on this question, huh?

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!