Same search - using different servers (host) - display on different dashboards.

[JYTTEJ]

I need to establish the same dashboard for each of our Test, pre-prod and production environment.

I.e. the same searches should be used - with the only difference of the host name.

Example:

MID="*E" OR MID="*A" | stats count by host| rangemap field=count low=0-0 elevated=1-1 default=severe

I want the result shown into one of the three dashboards, depending on the hostname.

I.e. when the host= PSDKXP0* -then the result is shown in PRODUCTION dashboard

When host = PSDKXM0* - then the result is shown in the PRE-PROD dashboard

When host= PSDKXT0* - then the result is shown in the TEST dashboard.

How do I accomplish that?

[gnovak]

I've been working with dashboards for a bit so figured I'd ask questions and maybe help or learn even more!

In your dashboards are you using saved searches or inline searches for the dashboard?

Can you add host=PSDKXP0* (for example) to the beginning of the search for the production dashboard and see what your results are?

Or were you looking to use splunk to filter them automatically? I assume automatically.....

[JYTTEJ]

I use saved searches in my dashboards - and yes - you are right in the above comment. I want to use only 1 query - and based on the host name, I want the result to be put on a particular dashboard. So, does anybody know how I do this?

[gnovak]

oh wait i think i get it...you want the search to run, results to be generated, and then based on the host name in the list of results have that host name show up on a certain dashboard....correct?

So 1 query looking for "stuff", the query finds "stuff" and then puts the "stuff" on a particular dashboard based on the hostname...gotcha....