Getting Data In

How to Automatically Generate Custom Dashboards in Splunk When New Data is Fetched?

TestUser
Loves-to-Learn Lots

I’ve developed a custom Splunk app that fetches log data from external sources. Currently, I need to dynamically create dashboards whenever new data types/sources are ingested, without manual intervention.

Labels (1)
0 Karma

livehybrid
SplunkTrust
SplunkTrust

HI @TestUser 

I think as @gcusello has stated here, there isnt such a tool or capability within Splunk currently that would allow this, but its possibly something that with enough information could be built into an app. 

It would rely on a couple of key bits of information though, such as what the usecases for the dashboard are (e.g. what is it you want to visualise, and for whom etc) and also if the data is in a predictable (or ideally CIM compliant) format. e.g. can you reference fields reliably knowing their content (type) and names etc.

It might help if you could share a little more about what you are trying to achieve.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @TestUser ,

Jokingly, I would say with a magic wand!
In reality, at the moment there is no tool that allows this, even if, with the help of some Artificial Intelligence tools, we are getting closer.
In any case, at the moment, to my knowledge, there are no tools of this type.

Also because the new data must be identified and parsed; then you have to identify the filtering requirements and what you want to get as output, so I would say that at the moment it is not possible.
A help could come from the Splunk Security Essentials app (https://splunkbase.splunk.com/app/3435) that provides a tool for identifying data flows and presents them with some dashboards, but in any case there is always a manual component of identifying and implementing the requirements.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...