Getting Data In

How to Automatically Generate Custom Dashboards in Splunk When New Data is Fetched?

TestUser
Loves-to-Learn

I’ve developed a custom Splunk app that fetches log data from external sources. Currently, I need to dynamically create dashboards whenever new data types/sources are ingested, without manual intervention.

Labels (1)
0 Karma

livehybrid
Super Champion

HI @TestUser 

I think as @gcusello has stated here, there isnt such a tool or capability within Splunk currently that would allow this, but its possibly something that with enough information could be built into an app. 

It would rely on a couple of key bits of information though, such as what the usecases for the dashboard are (e.g. what is it you want to visualise, and for whom etc) and also if the data is in a predictable (or ideally CIM compliant) format. e.g. can you reference fields reliably knowing their content (type) and names etc.

It might help if you could share a little more about what you are trying to achieve.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @TestUser ,

Jokingly, I would say with a magic wand!
In reality, at the moment there is no tool that allows this, even if, with the help of some Artificial Intelligence tools, we are getting closer.
In any case, at the moment, to my knowledge, there are no tools of this type.

Also because the new data must be identified and parsed; then you have to identify the filtering requirements and what you want to get as output, so I would say that at the moment it is not possible.
A help could come from the Splunk Security Essentials app (https://splunkbase.splunk.com/app/3435) that provides a tool for identifying data flows and presents them with some dashboards, but in any case there is always a manual component of identifying and implementing the requirements.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...