Search icon CANCEL
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Conferences
Free Learning
Arrow right icon
Arrow up icon
GO TO TOP
Splunk 7 Essentials, Third Edition

You're reading from   Splunk 7 Essentials, Third Edition Demystify machine data by leveraging datasets, building reports, and sharing powerful insights

Arrow left icon
Product type Paperback
Published in Mar 2018
Publisher Packt
ISBN-13 9781788839112
Length 220 pages
Edition 3rd Edition
Languages
Tools
Arrow right icon
Authors (4):
Arrow left icon
Erickson Delgado Erickson Delgado
Author Profile Icon Erickson Delgado
Erickson Delgado
Steven Koelpin Steven Koelpin
Author Profile Icon Steven Koelpin
Steven Koelpin
J-P Contreras J-P Contreras
Author Profile Icon J-P Contreras
J-P Contreras
Betsy Page Sigman Betsy Page Sigman
Author Profile Icon Betsy Page Sigman
Betsy Page Sigman
Arrow right icon
View More author details
Toc

Table of Contents (10) Chapters Close

Preface 1. Splunk – Getting Started 2. Bringing in Data FREE CHAPTER 3. Search Processing Language 4. Reporting, Alerts, and Search Optimization 5. Dynamic Dashboarding 6. Data Models and Pivot 7. HTTP Event Collector 8. Best Practices and Advanced Queries 9. Taking Splunk to the Organization

Creating your first dashboard

Now that we have data in Splunk, it's time to use it in order to derive something meaningful out of it. You are still in the Destinations app, correct? We will show you the basic routine when creating new dashboards and dashboard panels.

Type in or copy/paste the following search query in the Search Field, then hit Enter:

SPL> index=main /booking/confirmation earliest=-24h@h | timechart 
     count span=15m

After the search results render, click on the Visualization tab. This will switch your view into a visualization so you can readily see how your data will look. By default, it should already be using the Column Chart as shown in the following screenshot. If it does not, then use the screenshot as a guide on how to set it:

Now that you can see your Column Chart, it is time to save it as a dashboard. Click on Save As in the upper-right corner of the page, then select Dashboard Panel, as shown in the following screenshot:

Now, let's fill up that dashboard panel information, as seen in the following screenshot. Make sure to select the Shared in App in the Dashboard Permissions section:

Finish up by clicking View Dashboard in the next prompt:

You have created your very first Splunk dashboard with a single panel telling you the number of confirmed bookings in the last 24 hours at 15-minute intervals. If you let Eventgen run for a while and rerun the dashboard, the contents will populate as the data is generated. Time to show it to your boss!

In one chapter we acquired, installed, and used Splunk. We now have a fully-functional Splunk installation with live data. Leave Splunk running for two hours or so. After a few hours, you can stop Splunk if you need to rest for a bit to suppress indexing and restart it when you're ready to proceed into the next chapters.

Do you recall how to control Splunk from the command line?

Windows:     C:Splunkbin> splunk stop
             C:Splunkbin> splunk start
C:Splunkbin> splunk restart
Linux: bin]$ ./splunk stop
bin]$ ./splunk start
bin]$ ./splunk restart
lock icon The rest of the chapter is locked
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Renews at £16.99/month. Cancel anytime