Dynamic hostname

[Marco]

Hi Splunkers,

I have created a dashboard and I hard coded the hostname. This has become an issue because I have multiple systems and in order to reuse the dashboard I have to manually change the hostname  in each of my visualization  inside the dash board. Is there a way to make hostname a variable and let the user input which hostname they would like to use?

EX:

List of hostnames:

S0W1SANDBOX

S0W1PRODUCTION

S0W1 WAREHOUSE

host=S0W1PRODUCTION

Thank you!

[gcusello]

Hi @Marco,

Did you tried to put the hostnames in a lookup and insert a dropdown in dashboard to choose the hostname?

Ciao.

Giuseppe

[Marco]

Hi @gcusello 

No, unfortunately that would not work in this situation because  since I eventually plan to put these dashboards into an app. I need to figure out how to make the hostname universal so everyone can you use it without having to change the hostname value.

Thank you Marco

[gcusello]

Hi @Marco,

have you an hostname related to each user?

if yes, you could read the current user and using the above lookup select the correct hostname.

To read the current user, use this search:

| rest /services/authentication/current-context | rename username AS User_Name | fields User_Name

Ciao.

Giuseppe

[Marco]

Hi @gcusello ,

No, I have a host name per System.  This is the Query i'm issuing is:

host=S0W1 | where like(COMMAND, "MKDIR%")| stats count(COMMAND) AS "Number of times MKDIR Command was issued"

Is there a way to make host name more plug in play friendly because as of right now if I want to run the reports in both systems I have to change the host name manually. 

EX:

host=S0W1 | where like(COMMAND, "MKDIR%")| stats count(COMMAND) AS "Number of times MKDIR Command was issued"

host=S0W1.PRODUCTION | where like(COMMAND, "MKDIR%")| stats count(COMMAND) AS "Number of times MKDIR Command was issued"

 

[Marco · Accepted solution]

Came up with a temporary solution, I set the host value equal to a wild card.

Ex: host = *

It's doing the job thanks guys!

[isoutamo]

Hi

How about to use a savedsearch to update that lookup? Then there will be always needed hostnames, if you have some rules which host you want to add to this dashboard?

r. Ismo