Splunk Search

Is there a way to export the Data Summary information on the Search Page to a dashboard?

mikesangray
Path Finder

I was looking at the Data Summary information on the Search page and noticed that there doesn't seem to be a way to export this data or view it in a better format. Is there a way to send this data to a dashboard?

It seems like the data is available in SoS, but the view is already created in 'Data Summary' and I assume (please clarify/correct) that it is viewable by anyone who can see the search page? Which then begs the question - can everyone see this data and drill into it? If so, can permissions be controlled? I don't need/want everyone/anyone to be able to see all of this information.

0 Karma
1 Solution

emiller42
Motivator

Looks like the data summary is coming from metadata searches. Example:

| metadata type=sourcetypes

You can build your own searches based on the data that command provides. What people can see is based on their role permissions. They won't see data for indexes they don't have access to.

View solution in original post

emiller42
Motivator

Looks like the data summary is coming from metadata searches. Example:

| metadata type=sourcetypes

You can build your own searches based on the data that command provides. What people can see is based on their role permissions. They won't see data for indexes they don't have access to.

mikesangray
Path Finder

Thanks, this helps.

The | metadata type= gets me what I need (hosts, sources, sourcetypes).

aljohnson_splun
Splunk Employee
Splunk Employee

The data summary represents the data that is available to the user in question and searchable by default. They may have access to other indexes (and if they aren't searchable by default, the counts for source/sourcetype/host, won't show up there).

For example, as admin, you likely have access to _internal and _audit but you won't see their sourcetypes etc. in the data summary unless those indexes are searched by default.

Please see this documentation on how to use access control to secure data in Splunk.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...