Creating a Splunk Dashboard

Introduction:

Once we have the alerts flowing to Splunk (https://documentation.capsule8.com/hc/en-us/articles/360048409373-Exporting-Alerts-to-Splunk) we can use those alerts to build a dashboard customized as per the user needs

Login to Splunk

Click on the Search tab

Search for the events by entering a query in the box provided as shown

For ex: sourcetype=access_* status=200

Once you have the search results, this can be used to create an Alert.

Click on the ‘Save As” drop down and select ‘Report’

Click on View to see the details or you can continue editing the settings in this pop up.

Now that the Report is created, you can add it to the dashboard by clicking the link “Add to Dashboard”

Dashboard: You can create a new dashboard or add the report to an existing Dashboard

Dashboard ID: Unique Id. This cannot be modified later

Dashboard Permissions: Allows you to select if you want to share the report to all the users of the application or reserve it for private viewing

Panel Powered By: You can select either ‘Inline Search’ or ‘Report’. You can hover the mouse over the options to get more details on what each of these options will do.

Click on Save and a message will be displayed as below

Click on View Dashboard

You can modify how the data is visualized.

Click on the ‘Edit’ button and then click on ‘Select Visualization. Hover over the items and you will be able to see a brief description on how data will be presented in each of these options.

For ex: Selecting the Pie chart will change the dashboard view as below

Please note that yon can edit the source directly which will be open an HTML view

You can add more controls to finetune the dashboard using ‘Add Input’

You can add more panels to the dashboard using ‘Add Panel’ which will give you the options to add a new panel or select from existing reports or close from other dashboards

For Ex: Cloning another panel from existing Dashboard

After the changes were saved, you have the option to set this as a home dashboard

This will set up the home page of the application

This can be modified anytime by Clicking the gear icon next to the title

To order the panels in the dashboard, you can click and drag the panels after adding them in dashboard.

You can add the search results directly to the Dashboard.

Click on the ‘Save As” drop down and select Dashboard Panel

After this you can follow the steps above to edit or continue adding dashboard panels as needed