Custom Icons in Splunk 6 Tables
“Daddy. DADDY! We’re out of Sriracha. Does Costco sell Sriracha? Can you go get some before you start working today?”
That was my five-year-old son at breakfast this morning, after he turned the Sriracha bottle upside down and banged the heck out of the bottom of the rooster-adorned bottle with his tiny fist, trying to get the last bits of the dark-red chili sauce deposited onto his scrambled eggs.
While I’m certain we will solve the 2014 Sriracha Crisis at the Brodsky household, the whole episode reminded me of a question (stick with me, you’ll see why) that a Splunk customer asked me a few months ago, which went something like this:
“When creating a dashboard in Splunk 6, …
Show/Hide a Dashboard Panel Based on a Search Result
Today’s post will build two of my previous posts about pivoting a single row table and toggling visibility of dashboard panels. In the post about pivoting a table, one of the fields in the table was an IP address. Wouldn’t it be nice to run the iplocation command on the IP address and display where the user was logging in from on a map? Yeah, that would be cool, but only if we had something to map. Otherwise, we just have an empty map.
So, what we will be doing today is use a post process search on the IP address to get the geostats. Then, if this post process search returns results, we will dynamically display …
Pivot a Single Row Table with a DataTemplate View
PowerShell has some cool object formatting features. Two of the most common are called Format-Table and Format-List. You can think of a Splunk Table as a Format-Table view, but what if you want to format your results as a list? This is especially helpful when you have a one-row table that starts to push the boundaries of your screen. Wouldn’t it be nice if you could pivot your table to have the headers as one column and the data as another? Well, with a DataTemplate View, you can do this very easily.
What We Will Be Doing
We will be turning this:
How It Is Done – Step 1 – Create a HTML dashboard
Toggle Visibility of Dashboard Components with jQuery
Sometimes a dashboard can become too busy to focus. This is especially true when you have both summary and detailed data on a Key Performance Indicator (KPI) dashboard. An example of this would be the Citrix XenApp app User Experience dashboard as seen below:
This dashboard scores the various components that impact a user’s experience – things like network latency, server performance, hypervisor performance, shared storage latency, Netscaler throughput, etc. There is just too much information to show all at once, so we hide parts of the dashboard and allow the user to view the detailed information of only what they want to see.
Toggle with Simple XML
Adding toggle buttons to hid/show parts of your dashboard isn’t all …
Big data and financial services – an EMEA perspective
I was lucky enough to attend the first day of the “Big Data in Financial Services” event in London a few days ago. I know some people might not think of that as lucky but I say it on the back of a surprisingly varied agenda, entertaining speakers and a lot of good debate and content on what big data means to FS companies and how they are using it.
The key point that I took away was that right now, FS companies are using big data today to focus on operational issues – risk, efficiency, compliance, security and making better decisions. However, there is a growing trend in FS companies looking at how big data is going …
Splunking Exchange in a Simple XML World
With the release of Splunk 5.0, the Simple XML language we use to define the dashboards and forms for an app was greatly extended. So, we were given a challenge – could a reasonably complex app, such as the Splunk App for Microsoft Exchange – be represented using only Simple XML?
Visualizing Big Data with Splunk
To all .conf attendees, thank you for attending my presentation today. It was really heart-warming to see the strong support from you. The room reached full-occupancy within minutes!
To those that missed this session, there will be an encore session to talk about the internals of the concept viz app. We’ll look at the design and then dive straight into the codes:
Visualizing your Big Data
Thursday, Sept 13, 2012
11:45am -12:15 pm
See you tomorrow and we’ll see how far your BIG data take you in your journey!
Follow me at @nicholaskey or http://blogs.splunk.com/author/nkey…
Speech-to-text with Splunk: converting natural language into Splunk search commands
Is that possible at all? At Splunk, we are constantly experimenting ways to make Splunk more usable. This new approach allows users to “talk” to Splunk (with a microphone) and transforms natural language into Splunk search command.
Notice the small little microphone icon in the textfield? That small little icon unlocks a huge potential to make splunk more user friendly.
Interested to learn more about this concept app?
Come join us at the Chalk-talk session on
Monday, September 10, 2012
5pm – 7pm
Gracia Commons, Level 3 Cosmopolitan Hotel…
Visualizing your Splunk /etc/apps directory
Here’s a thought. “Visualizing the content in the /etc/apps directory of your Splunk instance”. Is that possible with Splunk? There’s an app for that.
Here’s a sneak preview of the app …
Come join us and learn more in the Developing on Splunk sessions at .conf!…
Visualizing your data with Splunk
Hello! How may I help you? Hmmm … you want to visualize your indexed data with other means other than the traditional pie charts, bar charts and tables? I see … and you want to have full control to integrate external tools and plugins into your app because you are feeling adventurous? Is that possible with Splunk?
Come join us and learn more in the Developing on Splunk sessions at .conf!
Let’s discover together the interesting yet easy to understand approach in developing custom apps that work seamlessly with Splunk as your data platform. Explore the ways how to make use of external tools to visualize your events as illustrated below:
Wow … what did you just see? …