Dashboards & Visualizations

How to load this external data in a dashboard without saving it in Splunk?

fedejko
Explorer

Hello,

I have a dashboard which is using one token - as a result two things happen:

  • a search is conducted on an index with some static data
  • I want to load data from external source (.txt file available online) which changes every hour

This is the source: 

https://tgftp.nws.noaa.gov/data/observations/metar/stations/KJFK.TXT

Desired state: The dashboard takes airport's ICAO code and displays static information about this airport from the index and also loads external current weather information (which changes very frequently).

How to load this external data in a dashboard without saving it in Splunk?

I would like to state, that I have no option to ingest this data into an index every hour, or create a lookup file locally - this data will change all the time so ideally I would like to fetch it online every time.

Many thanks in advance!

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @fedejko,

if you want to load a csv on file system, you could try the inputcsv comman (https://docs.splunk.com/Documentation/Splunk/9.0.3/SearchReference/Inputcsv).

If instead you want an upload window, this feature isn't available, you have to load it using a php or Python program.

Maybe the best approach should be to have an input that reads files from a folder where you put the files, but this means index it in Splunk.

Ciao.

Giuseppe

 

0 Karma

fedejko
Explorer

Hi,

Thanks for your reply, but I cannot store it in csv or in an index. I want to load this one line of text from online source every time.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @fedejko,

if you want to add only one line at a time, you could use a text input in a dashboard to add the line.

Ciao.

Giuseppe

0 Karma

fedejko
Explorer

You don't understand. I want the dashboard to display this line automatically, not to paste it myself - that would be pointless. If you want to help me - please read the description of my issue again.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @fedejko,

sorry for the misunderstanding!

let me summarize:

  • you have a text file on filesystem,
  • in each text file there's only one raw,
  • you want to load this raw in a dashboard without indexing it,
  • you want to use this raw in a search;

is it correct?

Anyway, why do you want to not index the information from this file?

reading this file every time it is updated and indexing it, you have all you need.

In Splunk only the contents in indexes or in lookups are searchable, you don't want to put these information neither in indexes or in lookups so it isn't possible.

At least you have only two solutions:

  • index this file: it's the easiest best performant and more efficiant solution;
  • copy the file in a lookup with a ascipt and read it as a lookup.

Ciao.

Giuseppe

 

 

0 Karma

fedejko
Explorer

Hey,

"let me summarize:

you have a text file on filesystem,"

No, I have weather data available online which I want to "pull" to my dashboard. It has a URL like this: https://tgftp.nws.noaa.gov/data/observations/metar/stations/<XXXX>.TXT

And for each dashboard load I will put the search term in a field and I want to load a specific content from a URL. If I specify "KJFK" the url loaded will be

https://tgftp.nws.noaa.gov/data/observations/metar/stations/KJFK.TXT (for John F. Kennedy airport)

If I specify CYYZ, the url will be

https://tgftp.nws.noaa.gov/data/observations/metar/stations/CYYZ.TXT (weather for Toronto airport).

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @fedejko,

it isn't possible to pull a data to a dashboard,

in a dashboard you can read a data from an index, a lookup or a csv or a manual input text box, not pulling data from outsoude of these input modes.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...