Splunk Search
Highlighted

Is there a way to export the Data Summary information on the Search Page to a dashboard?

Path Finder

I was looking at the Data Summary information on the Search page and noticed that there doesn't seem to be a way to export this data or view it in a better format. Is there a way to send this data to a dashboard?

It seems like the data is available in SoS, but the view is already created in 'Data Summary' and I assume (please clarify/correct) that it is viewable by anyone who can see the search page? Which then begs the question - can everyone see this data and drill into it? If so, can permissions be controlled? I don't need/want everyone/anyone to be able to see all of this information.

0 Karma
Highlighted

Re: Is there a way to export the Data Summary information on the Search Page to a dashboard?

Motivator

Looks like the data summary is coming from metadata searches. Example:

| metadata type=sourcetypes

You can build your own searches based on the data that command provides. What people can see is based on their role permissions. They won't see data for indexes they don't have access to.

View solution in original post

Highlighted

Re: Is there a way to export the Data Summary information on the Search Page to a dashboard?

Splunk Employee
Splunk Employee

The data summary represents the data that is available to the user in question and searchable by default. They may have access to other indexes (and if they aren't searchable by default, the counts for source/sourcetype/host, won't show up there).

For example, as admin, you likely have access to _internal and _audit but you won't see their sourcetypes etc. in the data summary unless those indexes are searched by default.

Please see this documentation on how to use access control to secure data in Splunk.

0 Karma
Highlighted

Re: Is there a way to export the Data Summary information on the Search Page to a dashboard?

Path Finder

Thanks, this helps.

The | metadata type= gets me what I need (hosts, sources, sourcetypes).