Splunk Search

How do I create a dashboard with my searches?

rajgowd1
Communicator

hi,

I have data like below and extracted fields hostname ,logname and data. By using these and existing defaults fields, I'm trying to create a dashboard with good representation.

Mon Nov 14 23:51:31 2016,vm-a1fc-d5f5,/var/log/messages,key,Nov 14 23:23:59 vm-21dd-d4f2 ssh-server-g3: 702 Auth_methods_completed, Username: kal, Auth methods: publickey, Src IP: xxx.xxx.xxx.xxx, Src Port: 53370, Ver: SSH-2.0-OpenSSH_5.8, Session-Id: 70

I used the searches below to create some tables. It would be great if someone help with dashboard searches:

index=pub_cto_luna_hsm | stats list(data) by hostname logname |rename list(data) as Data

index=pub_cto_luna_hsm | chart values(data) by hostname logname
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi rajgovd1,
I usually put in my Dashboard a time distribution, For example, by host using timechart

Index=yourindex | timechart count by host

After I insert one or more relevant pie graphs
Index=yourindex | stats count by host
Index=yourindex | stats count by logname

And after a table with all fields
Index=yourindex | table ...

In the top you could insert one filter For each relevant field.

At the end you could use a base search to have a more efficient Dashboard.
If you don't know how to do this, download the Splunk Dashboards Examples App to see how to do all.

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi rajgovd1,
I usually put in my Dashboard a time distribution, For example, by host using timechart

Index=yourindex | timechart count by host

After I insert one or more relevant pie graphs
Index=yourindex | stats count by host
Index=yourindex | stats count by logname

And after a table with all fields
Index=yourindex | table ...

In the top you could insert one filter For each relevant field.

At the end you could use a base search to have a more efficient Dashboard.
If you don't know how to do this, download the Splunk Dashboards Examples App to see how to do all.

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...