Splunk Search

How do I create a dashboard with my searches?

rajgowd1
Communicator

hi,

I have data like below and extracted fields hostname ,logname and data. By using these and existing defaults fields, I'm trying to create a dashboard with good representation.

Mon Nov 14 23:51:31 2016,vm-a1fc-d5f5,/var/log/messages,key,Nov 14 23:23:59 vm-21dd-d4f2 ssh-server-g3: 702 Auth_methods_completed, Username: kal, Auth methods: publickey, Src IP: xxx.xxx.xxx.xxx, Src Port: 53370, Ver: SSH-2.0-OpenSSH_5.8, Session-Id: 70

I used the searches below to create some tables. It would be great if someone help with dashboard searches:

index=pub_cto_luna_hsm | stats list(data) by hostname logname |rename list(data) as Data

index=pub_cto_luna_hsm | chart values(data) by hostname logname
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi rajgovd1,
I usually put in my Dashboard a time distribution, For example, by host using timechart

Index=yourindex | timechart count by host

After I insert one or more relevant pie graphs
Index=yourindex | stats count by host
Index=yourindex | stats count by logname

And after a table with all fields
Index=yourindex | table ...

In the top you could insert one filter For each relevant field.

At the end you could use a base search to have a more efficient Dashboard.
If you don't know how to do this, download the Splunk Dashboards Examples App to see how to do all.

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi rajgovd1,
I usually put in my Dashboard a time distribution, For example, by host using timechart

Index=yourindex | timechart count by host

After I insert one or more relevant pie graphs
Index=yourindex | stats count by host
Index=yourindex | stats count by logname

And after a table with all fields
Index=yourindex | table ...

In the top you could insert one filter For each relevant field.

At the end you could use a base search to have a more efficient Dashboard.
If you don't know how to do this, download the Splunk Dashboards Examples App to see how to do all.

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...