Dashboard Creation

[sushma7]

Hi,

Is it possible to collect metrics from two apps and draw a combined dashboard which is common for both? What sort of query should I write for it?

The other question is are the dashboards are static? or will they get updated as the data is indexed into SPLUNK?

Thanks,
Sushma.

[somesoni2]

All splunk data, it may be from any app, will be stored in indexes under respective source/sourcetypes. So yes you can create a dashboard which can take data from any index/source/sourcetype (to which user of dashboard has access) and display data.

To make write queries which shows data from one or more apps (in turn index/source/sourcetype), use query like this

(index=indexA OR index=indexB ...) (source=sourceA OR source=sourceB...) (sourcetype=sourcetypeA OR sourcetype=sourcetypeB...) | further search commands per your requirement.

Dashboards are static (xml files) and search query inside them are also static and don't change with indexed data. [data shown in dashboard will 🙂 ]

[somesoni2]

The data in dashboard will not be static, it will be the result of the query at the time of opening of dashboard.

[sushma7]

What I didnt get is one thing per suppose I wrote a query to collect the cpu utilization from the windows boxes and selected the time range picker as 60 minutes, then it would display the cpu utilization of last 60 minutes if I add it to the dashboard,it is going to be static right? whenever i open and see the dashboard it would be displaying the same result?

[sushma7]

Restarting again the forwarder has resolved my issue...

Thanks!!!

[sushma7]

Ok, one more question all the data that is indexed goes by default into main, I am aware of it. In my case I installed windows app and its add-on on a windows box, now i want that windows box to index the data into a separate index that I have created. To do so I edited the inputs.conf file and added the line index = test(the one I created) under SplunkForwarder\etc\apps\Splunk_TA_Windows\default.inputs.conf and restarted the forwarder, logged into main Splunk instance and in the search query I searched for index=test, but it is showing zero events. Is there anything am supposed to do?

[Ayn]

Yes, it is possible. Dashboards are typically possible to make highly dynamic, but it's hard to say more than that without knowing more about what more exactly you want to accomplish and what your scenario looks like.

[sushma7]

I need to create a dashboard which contains both the OS metrics and as well as Event log information.

I need to have a query which provides the information from the above two apps and display under a single dashboard. Can you please help me to write a query for this?

So far I installed two apps i.e.Splunk app for windows and Splunk app for Unix and Linux.

Thanks,
Sushma.