2 hours 29 minutes
in this video will build on our search knowledge further to create reports and dashboards.
Reports are basically saved. Searches or pivots.
We haven't talked about pivots, but it's an alternative way of presenting data without using the ***. Search processing language.
When creating a pivot, you can select the rows and columns you want and play with different formatting and statistical options. It can be useful, but I think it's more important in the beginning to get used to using the Splunk search language.
Here are a couple of screen shots for a reference.
When you run a search, you could click
under statistics the pivot option.
And then it takes you to a screen like this where you have
a lot of different options for
changing how the data is prevented.
Reports can be scheduled, or you can run them when you feel like it.
You can also have a report. Trigger actions like an alert
dashboards can help you visualize and interact with data.
User could, for example, type in and submit a cured that returns events that matches
when a dashboard takes in user input. It can also be referred to as a form
APS with user interfaces have them in the form of dashboards, and you could make your own pretty easily.
You can use the Splunk interface for creating simple dashboards or dive into the simple external source code for more advanced changes.
You also have the option of converting a dashboard to HTML to work with.
With that introduction, let's get into *** and take a look.
I have a search here.
I was looking at the
disc usage on my splint server
to say that as a report, I'm gonna go to save as report
and type in Splunk
disc usage and go to save.
Now if I want to view it, I can click here.
And if I wanted to change the time frame, are we looking at? I could go up here.
I can also go here and do things like that. It permissions
so I can let
other people look at this,
and I can also add it. The schedule. So once I scheduled this, I have a few differ options come up.
I could, for example, said it to run every week,
a certain time and day
over a cross a certain time range.
I also have the option of setting a priority.
This is useful in cases where you may have multiple reports and searches going and don't have a powerful enough environment to run them all at once.
The schedule window option
down here lets me pick a time frame
Spawn Kim, pick one to run it
in order to improve the efficiency
of the searches and reports that are running.
If you have a report that you really only need once a day and a lot of other searches going,
you could tell it to run any time in this in one of these windows.
reports are very similar to alerts
here. We could add
a trigger action
of That's the same for an alert, such a sending an email
with the attached results.
We could also place this report inside a dashboard
to create a dashboard.
I can be in the search and reporting Ap and then click dashboards
and then I can click Create new dashboard,
and I'm just gonna name it here
and click create.
I'm going to stick to the user interface for this example,
but as you remember, you do have the option of modifying the source code.
One of the first things I may want to do is at a panel.
I could create a new one, or it could build one off the report we just made.
So if I show more,
I can add a ***. This usage report,
I could give it a name, and I can also play with the visualization
known. These are particularly useful for this search, but some of them are really good. Like
using the geo stats
option can be really good for a variety of things, like looking at the sources of Loggins. Or
have a breakdown of the types of errors that you're seeing for a Pacific source type.
I'm gonna go ahead and add another panel and created new this time
off like statistics table,
and have it look at all time.
I'll leave the option of
using the time picker. And I'm just gonna add in a simple search here
this look that when those event logs and just doesn't event
by user name,
you gonna add this to the dashboard?
If I want, I can move these around. So if I think this one should be on top or maybe just off to the side of that. When I could do that,
for some of these formatting options, I could do something like
add an overlay of a heat map,
where it gives these higher number a darker color.
I can also add a user input, such as
time input, where they could select the time that they want for the results on this dashboard,
when they're set to pay attention to that
and for fun, I'm gonna change this to a dark theme and click save
and no, go ahead and refresh this
great. Here's our brand new dashboard
Do you remember
what a dashboard that takes in user input can be called?
There's a specific word I'm looking for.
The answer's form. Dashboards can be made to let users click on options and enter in information
that changes what's presented on a dashboard.
In the next video, we'll cover some APP basics
Splunk online test helps to assess knowledge of Splunk which is an advanced, scalable and ...
Event Log Collection
In this lab you will use Splunk Enterprise to ingest logs from a local host ...