How to Automatically Generate Custom Dashboards in Splunk When New Data is Fetched?

[TestUser]

I’ve developed a custom Splunk app that fetches log data from external sources. Currently, I need to dynamically create dashboards whenever new data types/sources are ingested, without manual intervention.

[livehybrid]

HI @TestUser 

I think as @gcusello has stated here, there isnt such a tool or capability within Splunk currently that would allow this, but its possibly something that with enough information could be built into an app. 

It would rely on a couple of key bits of information though, such as what the usecases for the dashboard are (e.g. what is it you want to visualise, and for whom etc) and also if the data is in a predictable (or ideally CIM compliant) format. e.g. can you reference fields reliably knowing their content (type) and names etc.

It might help if you could share a little more about what you are trying to achieve.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[gcusello]

Hi @TestUser ,

Jokingly, I would say with a magic wand!
In reality, at the moment there is no tool that allows this, even if, with the help of some Artificial Intelligence tools, we are getting closer.
In any case, at the moment, to my knowledge, there are no tools of this type.

Also because the new data must be identified and parsed; then you have to identify the filtering requirements and what you want to get as output, so I would say that at the moment it is not possible.
A help could come from the Splunk Security Essentials app (https://splunkbase.splunk.com/app/3435) that provides a tool for identifying data flows and presents them with some dashboards, but in any case there is always a manual component of identifying and implementing the requirements.

Ciao.

Giuseppe