Splunk Basic: How to create dashboard with interactive filters and submit button

[@LouisDuran]

Nice video. This helped me create my first production dashboard! Honestly, this was better than the Splunk documentation. A more real world example that I could adapt to my needs. Thanks for the Github. Saved me a lot of typing. 🙂

[@MahaLakshmi-nw3gu]

True i created my dashboard and presented to client with this video's help..Thanks alot

[@ThePhormio]

Excellent job making these videos. You're doing people in the growing Splunk community a great service.

[@BlueTeamConsultingLLC]

great video! Love to see the splunk community growing on youtube!

[@MikeAetherial]

Thank you! Base Search is what I needed to make all this work.

[@Dakktyrel]

Very well done, easy to follow. I like the errors you included, it makes the video very personal. Thank you

[@splunk_ml]

Thanks mate

[@anujaveluru]

Super helpful. Step by step guidance

[@GregoryBaskincom]

Great videos you have. I've searched "countless" videos and information before for a long time. Yours are straight to the point and VERY helpful. Have a question: How would you add another interactive dashboard the pops up on the same dashboard?

[@manigandanumapathy4840]

Very clear explanation and easy to understand the concepts. Appreciate your effort😊👍

[@splunk_ml]

Thanks Mani :)

[@TheExplorist]

Execellent Job you have done brother...thanks a lot for sharing this ..

[@navaneethvr]

No words!! Nicely explained!! Awesome job!!

[@88addiction]

Cristal clear... Nicely explained.. Thanks

[@vikki5329]

Thanks for making such a awsome videos bro❤

[@ajayfzsgaming9255]

Thank for the video sir, could you please make a video on the interview questions and answers, with examples.

[@VISHALSINGH-gc7ic]

Very nice session

[@splunk_ml]

Thank you 😊

[@vinodhkumar.s2927]

Hi sir,I found it extremely helpful, can u please share that movie dataset u had used and other datasets used in playlist for both dashboard classic and dashboard studio

[@reneschluter1640]

great video, good to understand, made my first dashboard with this

[@froogggyyy]

Excellent Job

[@sarinasalim2494]

Fantastic tutorial. Thank you.

[@surendrareddy3910]

Nice explanation .....

[@vijayb171]

Excellent one. Thanks for sharing

[@jimmyhenderson8926]

thank you for making these videos, please keep making them :)

[@splunk_ml]

Thx Jimmy..:)

[@RovshanMusayev]

Very useful video.

[@joemonta1702]

Excellent.... Thanks

[@pglanville]

Thank you for this. It was very helpful.

[@itsport2478]

Thank you very much sid sir....

[@Dorff_Meister]

Excellent video! I have a Dashboard that will be updated tomorrow.

[@splunk_ml]

Thanks Kevin 👍

[@moumitapan5726]

Very Helpful ..thanks a lot 😊

[@amitarathore1576]

Very helpful

[@starmedia62]

I prefer the GUI interface for dashboards, its fine, but more time consuming to craete dashboards.

[@wondwossenabebe3448]

Thank you so much for sharing your knowledge. It is very clear and informative. Can you please do a video on sending Syslog data to splunk . Thank you Wondwossen

[@santhoshig7784]

fantastic explanation!!

[@siddharth2692]

where is the previous video? Can you pls share the link. I want to watch the first video mentioned here.

[@kumaryadav943]

Good Stuff

[@rsrini7]

Super Cool. Thanks.

[@KanePat]

Great job, thank you very much 👍

[@Sugreev916]

Hi Sir Awesome Explanation Learning a lot !!! What type of input source you are using in this vedio...How to index the input source

[@splunk_ml]

Hi Sathya, Thanks. Regarding the input source you can checkout my other video kzbin.info/www/bejne/gKTLemmAiZtjiNU. Please note that there was a small issue with the script in video description I have given the github link for correct code. Please have a look.

[@prashantjha9035]

Can we create multi app dashboard in splunk, multiple apps in one graph or pie chart

[@anuppaudel]

Hi Siddhartha, I am looking to deploy (GET/POST/DEL) Dashboards with REST API, is that something we can do with Splunk API? I was not able to get a proper example over splunk or internet search, can you please help me with it?

[@vishwa4908]

Awesome, very helpful

[@chandankjha1156]

Hello, the video is very useful and informative!! I was trying to create a dashboard with multiple dropdown inputs... while I was trying to pass the token with $$ unfortunately it's not getting refreshed and no data error showing in all the panels I can able to do with only one token. Will you please suggest or guide me on this?

[@rajenderprasad1193]

Thank you.. can we display 0 for the search with no events..

[@Muzikparadiso]

Hi, I was working with Macros. In one of the prebuild dashboard there is a macro and it is defenition contain a special word - $monthSpl$ . What is this Monthspl and how can i see this in splunk.

[@splunk_ml]

$monthSpl$ is the input parameter of the macro. In your query where you are calling this macro you should have passed some values to it, that would be captured as $monthSpl$

[@padraic1983]

Hey Question, wouldn't have been easier to just use a regular expression to extract the year?

[@splunk_ml]

yeah we can do that too. Even we can keep this year extraction in props as well so that we dont need to explicitly extract in our query.

[@neutral911]

Hi bro... Where to refer the syntaxes for building queries?

[@pjdaksh]

how did you add those logs and where we have to take those logs

[@n.r.7616]

in your video playlist of splunk if I have to learn splunk from where I have to watch your video

[@architkhanna]

Hi Sid, Happy New Year! Hope you are doing good. Really informational videos I see on your channel. Will it be possible for you to demonstrate features like show/Hide panels within a Splunk dashboard by user's choice.

[@splunk_ml]

Happy New Year Archit. For your requirement please find the below video I created before, kzbin.info/www/bejne/jn2yiIyprL6Nd9U

[@anandruparelia8970]

Quick question here: If I only give index= "myindex" | fields * in base search query of dashboard and then I use that base search query for other panels, Is it a good idea to optimize dashboard loading time or not?

[@splunk_ml]

Its always good to use only those fields which you need for your panels. field * will also include _raw field as well ...so if the serach output is huge it will eat up the user disk quota.

[@alokkashyap3970]

Awesome

[@pradeepkumarRPK]

Excellent how to get logs in json format

[@taruchitgoyal3735]

Hello Sir, I need your help with below scenario:- I need two input panels: dropdown and textbox, such that the dropdown gives a list of macros, and when we select one of the option, it's corresponding macro definition gets loaded in the textbox. So far, I have been able to create a dropdown which invokes each macro by selecting one of the option. Thank you.

[@splunk_ml]

You can use the below rest command to list all the macros, (in dropdown) | rest splunk_server=local /servicesNS/-/-/admin/macros | table title, args, eai:acl.app, definition Then use the below rest command to display the definition of each macro, | rest splunk_server=local /servicesNS/-/-/configs/conf-macros You need to pass the token from your dropdown to the second search

[@taruchitgoyal3735]

@@splunk_ml Thank you Sir.

[@splunkvicky7406]

Hi Sir!!! Awesome content. Now I got a better idea of streamstats. One kind request can you please create the same way for eventstats. I am not getting how to work with it. It would be really helpful

[@splunk_ml]

Actually there is not much to talk about eventstats, although I created two videos which may be helpful, kzbin.info/www/bejne/jJPHlqp6Yq91qJI kzbin.info/www/bejne/pXWVgXygqbGpbZY

[@splunkvicky7406]

@@splunk_ml thanks sir!!!

[@bharanikthippa1497]

Great Video on Dashboards, one clarification - how to get the counts on year-wise language-wise, genre-wise ?

[@splunk_ml]

You can use stats command to achieve that.

[@architkhanna]

Great Video, Sid, Will it be possible for you to do a video on how to preserve top filters when moving from one dashboard to another ?

[@splunk_ml]

Thanks Archit..regarding your question you mean drilling down from one page to another? you can pass the token as query parameter to the next page. I will try to create a video for this.

[@architkhanna]

@@splunk_ml Hi Sid,I mean, If a user choses a set of filters on one dashboard,they should remain intact once the user move on to next dashboard ,so that same set of steps(of choosing filter) need not to be done again.

[@prashantprabal007]

just impeccable...

[@momentric2351]

Hi sid, Will you help me here.I have to run each pannels individually based on selecting the particular pannel using radio buttons but the condition here is have to use only one input field for all pannels.

[@splunk_ml]

Hi Raghu, What you need to do is create a radio group and for each radio the value you can set is the panel level search. Then use the raido group token in your panel.

[@momentric2351]

@@splunk_ml hey Sid thank you,This is working but now I encountered another problem as the input is taking from radio button search starts running automatically and populating pannel.Can you suggest me how to avoid this,I have to run search after clicking submit button.

[@splunk_ml]

Hi Raghu, In that radio group change tag you can set token based on value selected in the radio and use that token in your panel level search, this will force the panel level search to wait for the token to set.

[@momentric2351]

@@splunk_ml Thanks Sid,This is working fine now.

[@mohit5434]

how did you get those logs? If you have the file, can you please share it? Thanks,

[@thangavelkannant81]

Excellent, Thank you

[@techtech8715]

Hi Sir Can you please let me know by default all your reports taking "All Time" to produce the results? Since you are not using any time picker and no earliest and latest values are mentioned so from where these reports know for what duration they should find the data. Can you please elaborate on it? Thanks in advance

[@splunk_ml]

Hi, The main intension behind this video was to show different filters, that why I didn't used timepicker. I have created separate video for timepicker.

[@moizzaveri5565]

After you create a tag, say , what key are you pressing to automatically get the end tag: ?

[@splunk_ml]

no key is required.. splunk automatically doing that when you press ">"

[@backlogbatch]

Thank you❤

[@pratikkadam1032]

Great content, Thanks a lot.

[@ajayvailaya2091]

absolutely awesome .

[@Chris_87BC]

Why Splunk and not tableau, power bi, or QlikView?

[@splunk_ml]

Well I mainly work in splunk as a technology, thats why trying to share my knowledge. If anyday I get enough knowledge in tableau, Power BI I will definitely cover them.

[@wadoods4245]

Can you please create a new video for tmdb getting data in?

[@vishwa4908]

Quick question, I'm using rex in base search along with named groups which is giving me error "Unexpected close tag" How can I escape named group tags in source?

[@splunk_ml]

Replace less that with < and greater than with >

[@vishwa4908]

@@splunk_ml does it maintain its default behaviour? I mean it capture groups ? Thank you for quick reply

[@splunk_ml]

It should... Internally splunk will replace it with .

[@vishwa4908]

@@splunk_ml Tq, it's working but values are not populating only showing All, when i type in search head it is showing results not sure where I'm missing

[@splunk_ml]

Will it be possible for you to send me the code example? I will take a look

[@neelabhprajapati5861]

Good vedio :)

[@snehalchikkodi7528]

Sir, can you make video on workflow actions in splunk? please

[@splunk_ml]

Yes.. Its in my todo. I will cover it soon.

[@ritvikmahadeshwar7236]

Hi Sid!! My base search is not working can you by any chance help me out

[@splunk_ml]

Can you please tell me what issue you are facing?

[@Bangouaman]

Great work. I'm interested in the raw xml of this dashboard can you please email a copy to your newest member? Regards Val.

[@splunk_ml]

Thank you. In the video description you will get the github link. From there you can download the xml

[@rmanky]

Ending every sentence with "okay" really made this hard for me to follow

[@phenomenal325]

this is far more complicated than just using power bi or tableau for reporting...

[@manojandem9653]

Hi Sir,can you share the dump file for this logs please,it will help me to practise more precisely,thank you

[@splunk_ml]

I am really sorry Manoj I lost the back up for the older videos :(

[@karantikoo2616]

where can i get the data files from ?

[@splunk_ml]

Please check this video, kzbin.info/www/bejne/gKTLemmAiZtjiNU

[@maheshsathe6762]

Can you provide me logs for above dashboard

[@splunk_ml]

You will find the github link in video description.

[@satyajitbhattacharya3562]

Great ! Can you please explain How to set alerts as per Business transaction ?

[@splunk_ml]

Thanks...I created lots of contents regarding splunk alerts..you can find them in splunk development playlist.

[@satyajitbhattacharya3562]

@@splunk_ml that's great ! Can you please share links as well ...

[@splunk_ml]

You can start from here kzbin.info/www/bejne/nInVp5RqasqMfM0 And follow the playlist.

[@verdedenim662]

i really wish i could understand what you are saying.

[@carolinarendon2550]

I dont find the app nor the logs only the code=0(

[@splunk_ml]

Hi Carolina, To get the log please follow the below video where I discussed the scripted input. kzbin.info/www/bejne/gKTLemmAiZtjiNU

[@rudencovictor4423]

4:47 - 04:52 - what was that ?

[@samaofficial6303]

Hi sir

[@samaofficial6303]

I did the same submit button true and whenchanged false but still on clicking submit btn dashboard is not refreshed...plz suggest