Dashboards & Visualizations

dashboard creation

sushmitha_mj
Communicator

I created a deployment app to make a forwarder pick data from a location and index it lets say index A.
Then I created another app whose index is index A , so I can use this app for data display.

Now I see data in the index, and search it using the"index=A" command.
But is this the best way to do it?
Should I not be able to see the data on the app's data summary screen?
Can I build dashboards by using "index=A" as a part of the query?

Tags (2)
0 Karma
1 Solution

masonmorales
Influencer
Can I build dashboards by using "index=A" as a part of the query?

Yes.

Now I see data in the index, and search it using the"index=A" command. But is this the best way to do it?

Yes, it is, but as you continue to add different kinds of data you will also want to specify in your searches: index=a sourcetype=b source=c host=d when possible.

Should I not be able to see the data on the app's data summary screen? 

Correct. You need to execute a search (or build a dashboard with panels that have searches) in order to see your data. The summary screen just lets you know that data is being indexed.

View solution in original post

marcoscala
Builder

In the Data Summary you see events from your (the user your using) default indexes. If index A is not among your default indexes, you won't see the number of events in the summary data.
To add it as default index, go to Settings - user management and change the role setting the user belongs to. that apples also for Admin user.

sushmitha_mj
Communicator

@marcoscala
I do not find user management under my settings and I also, do not find the index name anywhere in the data summary. I only find hosts, sources, sourcetype. where should I look for the index?

0 Karma

sushmitha_mj
Communicator

It worked...................... 🙂
Thanks...

0 Karma

masonmorales
Influencer
Can I build dashboards by using "index=A" as a part of the query?

Yes.

Now I see data in the index, and search it using the"index=A" command. But is this the best way to do it?

Yes, it is, but as you continue to add different kinds of data you will also want to specify in your searches: index=a sourcetype=b source=c host=d when possible.

Should I not be able to see the data on the app's data summary screen? 

Correct. You need to execute a search (or build a dashboard with panels that have searches) in order to see your data. The summary screen just lets you know that data is being indexed.

sushmitha_mj
Communicator

@masonmorales

I did perform a search. BuT I still cannot see the data in the summary. The problem is, it takes a lot of time to load the data (I have millions of records), each time I execute the search.

How do I get over this problem?

0 Karma

sushmitha_mj
Communicator

It worked... thanks...... 🙂

0 Karma

masonmorales
Influencer

No problem. In regards to improving load time, you may to take a look at the resources in this post: http://answers.splunk.com/answers/224261/does-accelerated-searching-cache-data-so-its-faste.html

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...