Is it possible to have splunk display its own splunk server logs on the dashboard? (logins, data additions, starts stops) I have been looking for a way to do this and I am unable to find anything of the sort. has anyone done this themselves or seen something relating to it?
Hi zblum,
check out indexes _internal, _audit, and _introspection
to get all the Splunk events.
See also the docs http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/WhatSplunklogsaboutitself .
You can also use the Splunk monitoring console http://docs.splunk.com/Documentation/Splunk/latest/DMC/DMCoverview to see a lot of reports and dashboards using these events.
Hope this helps ...
cheers, MuS