Dashboards & Visualizations

Dynamic hostname

Marco
Communicator

Hi Splunkers,

I have created a dashboard and I hard coded the hostname. This has become an issue because I have multiple systems and in order to reuse the dashboard I have to manually change the hostname  in each of my visualization  inside the dash board. Is there a way to make hostname a variable and let the user input which hostname they would like to use?

EX:

List of hostnames:

S0W1SANDBOX

S0W1PRODUCTION

S0W1 WAREHOUSE

 

host=S0W1PRODUCTION

 

Thank you!

Labels (2)
0 Karma
1 Solution

Marco
Communicator

Came up with a temporary solution, I set the host value equal to a wild card.

Ex: host = *

It's doing the job thanks guys!

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Marco,

Did you tried to put the hostnames in a lookup and insert a dropdown in dashboard to choose the hostname?

Ciao.

Giuseppe

Marco
Communicator

Hi @gcusello 

No, unfortunately that would not work in this situation because  since I eventually plan to put these dashboards into an app. I need to figure out how to make the hostname universal so everyone can you use it without having to change the hostname value.

 

Thank you Marco

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Marco,

have you an hostname related to each user?

if yes, you could read the current user and using the above lookup select the correct hostname.

To read the current user, use this search:

| rest /services/authentication/current-context | rename username AS User_Name | fields User_Name

Ciao.

Giuseppe

Marco
Communicator

Hi @gcusello ,

No, I have a host name per System.  This is the Query i'm issuing is:

host=S0W1 | where like(COMMAND, "MKDIR%")| stats count(COMMAND) AS "Number of times MKDIR Command was issued"

Is there a way to make host name more plug in play friendly because as of right now if I want to run the reports in both systems I have to change the host name manually. 

EX:

host=S0W1 | where like(COMMAND, "MKDIR%")| stats count(COMMAND) AS "Number of times MKDIR Command was issued"

host=S0W1.PRODUCTION | where like(COMMAND, "MKDIR%")| stats count(COMMAND) AS "Number of times MKDIR Command was issued"

 Marco_4-1597416602818.png

 

 

 

 

 

0 Karma

Marco
Communicator

Came up with a temporary solution, I set the host value equal to a wild card.

Ex: host = *

It's doing the job thanks guys!

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

How about to use a savedsearch to update that lookup? Then there will be always needed hostnames, if you have some rules which host you want to add to this dashboard?

r. Ismo

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...