Dashboards & Visualizations

How do we list multiple constant values in the Splunk dashboard?

bsaujla131984
Path Finder

I have created a search to display Server up time for Windows servers... which works fine, however I would like to list applications related to the those servers... .

Can you anyone suggest please...

Tags (1)
0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

Each panel on a dashboard has a Splunk Search at its origin. The search you created for the server up time has fields that you can display in a table or chart, or you can pull specific values out of that search result and display it using tokens.

So however you are going to display it... it must begin with some kind of search. If you would like the applications on each server to display dynamically (i.e. when someone drills down on each server) then you'll be taking the server name/address value and passing it via token to the second search so that you are listing the apps from a particular server. In order to do that there are several ways one might use that server value. The most straight forward would be using the search server=$tok_blah$ example. where the value of the token is used as a filter in your second search. So It might look like index=foo |search server=$tok_blah$|stats count by application_name Or you might say instead `index=foo|stats list(application_name) by $tok_blah$

You'll want to look here: doc on tokens and dashboards
And here: which discusses contextual drilldowns in dashboards

Hopefully this will help get you started in the right direction.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...