I have built a dashboard for a team who will be monitoring it over a period of several hours daily. They have a response plan for each panel when something pops up. Is there a good method of allowing them to "acknowledge" or "suppress" an individual event within a panel after it's already been taken care of in order to keep the dashboard clean? Each panel refreshes automatically every 10 minutes. We are running Splunk 6.5.3.
Ideally it would clear the event from the dashboard permanently (i.e. subsequent visits to the dashboard will not re-load cleared events), but that isn't a hard requirement if the event remains cleared when the panels automatically refresh.
... View more
I have a dashboard built for a team that will be monitoring events from 6pm to 6am every day. Each panel refreshes every 10 minutes. We are running Splunk 6.5.3. Currently the timeframe set for the dashboard that the panels reference is
<input type="time" token="field1">
This only shows what we want starting at midnight. For example: If I checked the dashboard at 3am on Tuesday I will see events starting at 6pm Monday up until 3am Tuesday which is good. But if I were to check the dashboard at 9pm Monday, I will instead see events from 6pm Sunday to 6am Monday.
Ideally I'd like to implement logic so that the dashboard "resets" at 6pm daily, and runs until 6am the next morning and have that repeat every evening. I could be overthinking this so I am open to any suggestions. Thank you!
... View more