Dashboards & Visualizations

Dynamic hostname

Marco
Communicator

Hi Splunkers,

I have created a dashboard and I hard coded the hostname. This has become an issue because I have multiple systems and in order to reuse the dashboard I have to manually change the hostname  in each of my visualization  inside the dash board. Is there a way to make hostname a variable and let the user input which hostname they would like to use?

EX:

List of hostnames:

S0W1SANDBOX

S0W1PRODUCTION

S0W1 WAREHOUSE

 

host=S0W1PRODUCTION

 

Thank you!

Labels (2)
0 Karma
1 Solution

Marco
Communicator

Came up with a temporary solution, I set the host value equal to a wild card.

Ex: host = *

It's doing the job thanks guys!

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Marco,

Did you tried to put the hostnames in a lookup and insert a dropdown in dashboard to choose the hostname?

Ciao.

Giuseppe

Marco
Communicator

Hi @gcusello 

No, unfortunately that would not work in this situation because  since I eventually plan to put these dashboards into an app. I need to figure out how to make the hostname universal so everyone can you use it without having to change the hostname value.

 

Thank you Marco

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Marco,

have you an hostname related to each user?

if yes, you could read the current user and using the above lookup select the correct hostname.

To read the current user, use this search:

| rest /services/authentication/current-context | rename username AS User_Name | fields User_Name

Ciao.

Giuseppe

Marco
Communicator

Hi @gcusello ,

No, I have a host name per System.  This is the Query i'm issuing is:

host=S0W1 | where like(COMMAND, "MKDIR%")| stats count(COMMAND) AS "Number of times MKDIR Command was issued"

Is there a way to make host name more plug in play friendly because as of right now if I want to run the reports in both systems I have to change the host name manually. 

EX:

host=S0W1 | where like(COMMAND, "MKDIR%")| stats count(COMMAND) AS "Number of times MKDIR Command was issued"

host=S0W1.PRODUCTION | where like(COMMAND, "MKDIR%")| stats count(COMMAND) AS "Number of times MKDIR Command was issued"

 Marco_4-1597416602818.png

 

 

 

 

 

0 Karma

Marco
Communicator

Came up with a temporary solution, I set the host value equal to a wild card.

Ex: host = *

It's doing the job thanks guys!

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

How about to use a savedsearch to update that lookup? Then there will be always needed hostnames, if you have some rules which host you want to add to this dashboard?

r. Ismo

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...