Dashboards & Visualizations

Dashboard Creation

sushma7
Path Finder

Hi,

Is it possible to collect metrics from two apps and draw a combined dashboard which is common for both? What sort of query should I write for it?

The other question is are the dashboards are static? or will they get updated as the data is indexed into SPLUNK?

Thanks,
Sushma.

Tags (1)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

All splunk data, it may be from any app, will be stored in indexes under respective source/sourcetypes. So yes you can create a dashboard which can take data from any index/source/sourcetype (to which user of dashboard has access) and display data.

To make write queries which shows data from one or more apps (in turn index/source/sourcetype), use query like this

(index=indexA OR index=indexB ...) (source=sourceA OR source=sourceB...) (sourcetype=sourcetypeA OR sourcetype=sourcetypeB...) | further search commands per your requirement.

Dashboards are static (xml files) and search query inside them are also static and don't change with indexed data. [data shown in dashboard will 🙂 ]

somesoni2
SplunkTrust
SplunkTrust

The data in dashboard will not be static, it will be the result of the query at the time of opening of dashboard.

0 Karma

sushma7
Path Finder

What I didnt get is one thing per suppose I wrote a query to collect the cpu utilization from the windows boxes and selected the time range picker as 60 minutes, then it would display the cpu utilization of last 60 minutes if I add it to the dashboard,it is going to be static right? whenever i open and see the dashboard it would be displaying the same result?

0 Karma

sushma7
Path Finder

Restarting again the forwarder has resolved my issue...

Thanks!!!

0 Karma

sushma7
Path Finder

Ok, one more question all the data that is indexed goes by default into main, I am aware of it. In my case I installed windows app and its add-on on a windows box, now i want that windows box to index the data into a separate index that I have created. To do so I edited the inputs.conf file and added the line index = test(the one I created) under SplunkForwarder\etc\apps\Splunk_TA_Windows\default.inputs.conf and restarted the forwarder, logged into main Splunk instance and in the search query I searched for index=test, but it is showing zero events. Is there anything am supposed to do?

0 Karma

Ayn
Legend

Yes, it is possible. Dashboards are typically possible to make highly dynamic, but it's hard to say more than that without knowing more about what more exactly you want to accomplish and what your scenario looks like.

sushma7
Path Finder

I need to create a dashboard which contains both the OS metrics and as well as Event log information.

I need to have a query which provides the information from the above two apps and display under a single dashboard. Can you please help me to write a query for this?

So far I installed two apps i.e.Splunk app for windows and Splunk app for Unix and Linux.

Thanks,
Sushma.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...