>> In this video, we'll build on
our search knowledge further to
create reports and dashboards.
Reports are basically saved searches or pivots.
We haven't talked about pivots,
but it's an alternative way of presenting
data without using the Splunk search processing language.
When creating a pivot,
you can select the rows and columns you want and play
with different formatting and statistical options.
It can be useful,
but I think it's more important in the beginning to
get used to using the Splunk search language.
Here are a couple of screenshots for reference.
When you run a search,
you can click under statistics, the pivot option.
Then it takes you to a screen like this
where you have a lot of
different options for changing how the data is presented.
Reports can be scheduled or
you can run them when you feel like it.
You can also have a report trigger actions like an alert.
Dashboards can help you visualize and interact with data.
The user could, for example,
type in and submit
a keyword that returns events that match it.
When a dashboard takes in
user input it can also be referred to as a form.
Apps with user interfaces have them in
the form of dashboards
and you can make your own pretty easily.
You can use the Splunk interface
for creating simple dashboards
or dive into the simple XML source code
for more advanced changes.
You also have the option of
converting a dashboard to HTML to work with.
With that introduction,
let's get into Splunk and take a look.
I have a search here.
This is looking at the disk usage on my Splunk server.
To save it as a report.
I'm going to go to save as, Report,
and type in Splunk disk usage and go to Save.
Now, if I want to view it, I can click here.
If I wanted to change the time-frame
I was looking at, I could go up here.
I can also go here and do things like edit permissions.
I can let other people look at
this and I can also edit the schedule.
Once I schedule this,
I have a few different options come up.
I could, for example,
set it to run every week,
a certain time and day over a certain time range.
I also have the option of setting a priority.
This is useful in cases where you may
have multiple reports and searches
going and don't have
a powerful enough environment to run them all at once.
The schedule window option down here lets
me pick a time frame where Splunk can
pick when to run it in order to
improve the efficiency of
the searches and reports that are running.
If you have a report that you really only
need once a day and a lot of other searches going,
you could tell it to run anytime in one of these windows.
The scheduled reports are very similar to alerts.
Here we can add
a trigger action that's the same for an alerts,
such as sending an email with the attached results.
We could also place this report inside the dashboard.
To create a dashboard,
I can be in the search and reporting
app and then click Dashboards.
Then I can click Create new dashboard.
I'm just going to name it here and click Create.
I'm going to stick to the user interface
for this example.
But as you remember,
you do have the option of modifying the source code.
One of the first things that I may
want to do is add a panel.
I could create a new one or I could
build on off the report we just made.
If I show more,
I can add our Splunk dish usage report.
I could give it a name and I can
also play with the visualization.
None of these are particularly useful for this search,
but some of them are really good,
like using the Geo Stats option can be
really good for a variety of things
like looking at the sources of logins.
Or you could have a breakdown
of the types of errors that you're
seeing for a specific source type.
I'm going to go ahead and add another panel
and create a new this time.
I'll select Statistics table
and have it look at all time.
I'll leave the option of using the time picker.
I'm just going to add in a simple search here.
This looks at Windows event logs and just adds it as
event count by username.
Then I add this to the dashboard.
Now if I want, I can move these around.
If I think this one should be on
top or maybe just
off to the side of that one I can do that.
For some of these formatting options,
I can do something like add an overlay of a heat-map,
where it gives these higher number a darker color.
I can also add a user input,
such as time input,
where they can select the time that they
want for the results on
this dashboard when they're set to pay attention to that.
For fun, I'm going to change this to
a dark theme and click Save.
It'll go ahead and refresh this.
Great. Here's our brand new dashboard.
[NOISE] Now, do you
remember what a dashboard
that takes in user input can be called?
There's a specific word I'm looking for.
The answer is form.
Dashboards can be made to let users click on options and
enter an information that
changes what's presented on a dashboard.
In our next video,
we'll cover some app basics.