Guideance and/or Suggestions - displaying data from Splunk

[eholz1]

Greetings  Splunk Community,

I have a basice question on developing an application to display data from Splunk on a web page, in this case, a server created by node.js/express/axios.

I think I may be "barking up the wrong tree!" I do have an express/javascript app that displays data on tables on and index.ejs page from alerts condigured with the "webhook" feature. This works fine.

I am looking for a webpage that will display Splunk data from a webhook or t;wo,and a chart(s), and perhaps

may be able to run a defined searh from the page with a button click, etc. The idea I have, to to have a webpage that display status of certain data we have in Splunk. With out having to log into Splunk to view a dashboard, etc. I have looked at the splunk-sdk, and the search manager, but these seem to be deprecated. 

Is it possible to create some short  of a webpage on a server that just shows select data, and a chart or two?

Thanks,

eholz1

[livehybrid]

Hi @eholz1 

If you simply want to have dashboard accessible without logging in then you could look at https://help.splunk.com/en/splunk-cloud-platform/create-dashboards-and-reports/dashboard-studio/9.3....

If you need/want more customisation or you have more complex setup then you might want to look at https://github.com/livehybrid/dashpub which uses the Splunk UI Framework (https://splunkui.splunk.com/Packages/dashboard-docs/Introduction) to render full dashboards and runs searches in the background against Splunk.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[eholz1]

Hello and thanks for the replies.

Basically I have "no joy."  I looked at dashpub - seems it only runs in docker and would only show one dashboard with only ine panel with no capabiltiy to refresh or use timepicker. It could be that my version of Splunbk in 9.0.

I have a trial version of Splunk 10.4. I was able to publish one dashboard ONE time!. I can no longer view any dashboard if I try to publish it - I alwasy get "dashboard loading" message. Is there some sort of limitation using a trial version of Splunk with dfashboard publishing?  I check the permissions, and make sure they are not privatae, but viewable in the "app" or "all apps". Within Splunk it is no problem viewing the dashboards.

Webhooks work fine, maybe I need to look more in that area. So far, I have found trying to implement something with the use of the "Splunk>UI" fruitless.

I am still open for suggestions,

Thanks,

eholz1

[eholz1]

Hello and Thanks,

I will check all of the information you provided.

Thanks Very Much,

eholz1

[isoutamo]

Hi

i think that you are looking this https://splunkui.splunk.com?

With it you can do almost anything what you ever get. I have seen e.g. Doom inside Splunk UI 😉

[eholz1]

Hello and Thanks to isointamo!

I will check all of the information you provided.

Thanks Very Much,

eholz1