Dashboards & Visualizations

Same search - using different servers (host) - display on different dashboards.

JYTTEJ
Communicator

I need to establish the same dashboard for each of our Test, pre-prod and production environment.

I.e. the same searches should be used - with the only difference of the host name.

Example:

MID="*E" OR MID="*A" | stats count by host| rangemap field=count low=0-0 elevated=1-1 default=severe

I want the result shown into one of the three dashboards, depending on the hostname.

I.e. when the host= PSDKXP0* -then the result is shown in PRODUCTION dashboard

When host = PSDKXM0* - then the result is shown in the PRE-PROD dashboard

When host= PSDKXT0* - then the result is shown in the TEST dashboard.

How do I accomplish that?

Tags (1)
0 Karma

gnovak
Builder

I've been working with dashboards for a bit so figured I'd ask questions and maybe help or learn even more!

In your dashboards are you using saved searches or inline searches for the dashboard?

Can you add host=PSDKXP0* (for example) to the beginning of the search for the production dashboard and see what your results are?

Or were you looking to use splunk to filter them automatically? I assume automatically.....

0 Karma

JYTTEJ
Communicator

I use saved searches in my dashboards - and yes - you are right in the above comment. I want to use only 1 query - and based on the host name, I want the result to be put on a particular dashboard. So, does anybody know how I do this?

0 Karma

gnovak
Builder

oh wait i think i get it...you want the search to run, results to be generated, and then based on the host name in the list of results have that host name show up on a certain dashboard....correct?

So 1 query looking for "stuff", the query finds "stuff" and then puts the "stuff" on a particular dashboard based on the hostname...gotcha....

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...