Central Log Service (CLS) Splunk Dashboarding

Before you start

Before saving objects such as searches and dashboards, ensure you are in the correct App. Your app will appear in left-hand navigation, or in an Apps dropdown at the top of the page. Set your default app by clicking your name at the top of the screen and selecting 'Preferences.'

Save a search as a dashboard panel

  1. Change the time range to Last 15 minutes.
  2. Run the following search.
    index=vt_* | stats distinct_count(host) as hostcount
  3. This produces a count of unique host names. 
  4. Click the Visualization tab. The display shows a Line Chart by default.
  5. Change the Line Chart to Single Value.
  6. Click Save As and select New Dashboard
  7. Give it a name. Keep the default permissions setting Private until you are ready to share it.
  8. Select "Classic" dashboard as the type. ("Studio" offers better formatting options but lacks features Classic has. See Splunk's comparison of features for details.)
  9. Save to Dashboard 

You now have a dashboard with one report panel. To add more report panels, you can either run new searches and save them to this dashboard, or you can edit the dashboard directly.

Dashboard permissions

Dashboards link

For more information