Friday, August 6, 2010

Splunk Dashboard

Splunk search dashboard summary displays sources, sourcetypes and hosts. These hosts will list your actual server name. If you would like to have user friendly name for your hosts, follow these steps.
1) Navigate to http://{splunk_agent_host}:8000 and login to Splunk agent on target host.
2) Manager -> System settings -> General settings -> Index settings.
3) Update the Default host name (optional) field to have user friendly name
4) SSH into splunk agent and run these commands
 $SPLUNK_HOME/bin/splunk stop
 $SPLUNK_HOME/bin/splunk clear all
 $SPLUNK_HOME/bin/splunk start
5) Login to Splunk server and check the dashboard for discovery of user friendly host.
Note: The password may get reset due to clear all command.
------------------------------------------------------------------------------

By default, Splunk dashboard lists 10 hosts. When you have large no. of hosts, navigating 10 hosts at a time might be cumbersome. To increase the size of hosts displayed,
1) Navigate to Manager -> User interface -> Views -> Select 'search' as app context from dropdown -> dashboard.
2) Update this block in the section after  <!-- The list of hosts -->
        <module name="Paginator">
            <param name="count">25</param>
            <param name="entityName">settings</param>
            <param name="maxPages">25</param>
            <module name="SearchLinkLister">
3) Restart splunk server

0 Comments:

Post a Comment

Subscribe to Post Comments [Atom]

<< Home

Newer›  ‹Older