Is there a way to export the Data Summary information on the Search Page to a dashboard?

[mikesangray]

I was looking at the Data Summary information on the Search page and noticed that there doesn't seem to be a way to export this data or view it in a better format. Is there a way to send this data to a dashboard?

It seems like the data is available in SoS, but the view is already created in 'Data Summary' and I assume (please clarify/correct) that it is viewable by anyone who can see the search page? Which then begs the question - can everyone see this data and drill into it? If so, can permissions be controlled? I don't need/want everyone/anyone to be able to see all of this information.

[emiller42 · Accepted solution]

Looks like the data summary is coming from metadata searches. Example:

| metadata type=sourcetypes

You can build your own searches based on the data that command provides. What people can see is based on their role permissions. They won't see data for indexes they don't have access to.

[mikesangray]

Thanks, this helps.

The | metadata type= gets me what I need (hosts, sources, sourcetypes).

[aljohnson_splun]

The data summary represents the data that is available to the user in question and searchable by default. They may have access to other indexes (and if they aren't searchable by default, the counts for source/sourcetype/host, won't show up there).

For example, as admin, you likely have access to _internal and _audit but you won't see their sourcetypes etc. in the data summary unless those indexes are searched by default.

Please see this documentation on how to use access control to secure data in Splunk.