I am trying to count the number of events that I am unable to send to Splunk. I need these in a dashboard where I can just type them in when I get them.
For example, I have 13 events from yesterday and on my dashboard I want to just be able to add them to the current count. This way someone can still see the number of events even though I don't send them to Splunk. The only value I need is a number nothing else.
Is this possible to do, or am I completely crazy? Thank you!
Hi @nate_c
you can add, update, delete data by working with a kvstore or lookup.
and you can use lookup commands like inputlookup, outputlookup, lookup to work with kvstore or lookup files & also show these data as panels in the dashboards.
go through this splunk doc, can be helpfull
http://dev.splunk.com/view/webframework-tutorials/SP-CAAAEZT
Thanks