I really could use some help building a basic dashboard.
To make a long story short and get to the meat of this post, I'm new to splunk and said I could deliver a dashboard without knowing if I could. I'm really close but I'm stuck. Minus a night of sleep, I have been at this for almost 48 hours straight. I've read probably 100 posts from sideview (you = awesome), all of the relevant documentation within his app and tons of splunk.com documentation.
What I am trying to do is create a dashboard that displays the status of ping and port scan for a group of hosts and ports. I used the Asset Discovery app to generate the data within Splunk and it's working fine. I have all my fields and life is good there.
First, I used Splunk 6 Dashboard examples app and saw the Single Value color changing example. I built this using Simple XML using a search for each value. Needless to say that didn't quite work. I then went into SideViews Utils and read the HTML Module doc and tried using the PostProcess to replace Single Values example as a basis for my dashboard. After many failures, I think I have my search mostly working. I am not using any transforming commands but I have it limited to only the last 3 minutes of data, so it should always be under the 10,000 row limit. I had issues at first but once I explicitly told it what fields to return, it seems to be OK.
My problem is on the display and specifically the CSS. I am not a web designer and I apologize for my ignorance on that front.
Here's my dashboard code - h t t p://pastebin.com/0pYH7xnR
For the CSS I modified the Search app application.css to include the bit from the Sideview XML source. Here it is: h t t p://pastebin.com/MEgSR2aS
What I get when creating this is just a single "row" and only the first two searches show up. I get the name ($results[0].dest_host$), the range ($results[0].range$") and the IP ($results[0].dest_ip$). The range coloring is not working but I'm sure that has to do with the search string and I can figure that out after I get it actually displaying the data. Here is a screenshot: h t t p://imgur.com/SVZ8CdB
I do not know why this is happening as I've meticulously compared what I have to the SideView example. Is it because I am using this as part of the "Search" app? Am I supposed to make my own app and put it in there so it doesn't inherit CSS settings from the default search app?
PLEASE help!
... View more