Reporting

Splunk lets you summarize the results of any search as a report, which can include both a chart and a table of results.

Let's start with a search for some firewall deny events.

index::sampledata deny

Report on a field

Open up the fields... menu and select all available extracted fields. You'll see that Splunk has done a good job of figuring out all the fields in the well-structured Netscreen firewall log format.

Once all of your fields are showing, use the filter dropdown on the field src and click the Report on this field link.

You are taken to the Report tab and Splunk shows you the count and percent of events matching your search along with a bar chart graphing the results. Note how Splunk has changed your search to:

index::sampledata deny | top src

We'll cover pipes and operators later in this tutorial.

Build a new report

You can also build a new report within the report tab. To do this, search for all of the access_common data in the sample index:

index::sampledata sourcetype::access_common

Select the field byte from the fields menu to the left.

In the parameters section enter "Show sum of byte vs time split by action." Then click Apply.

Pick a different chart

Change chart styles by selecting a type from the display as drop-down menu above the current chart.

The types of charts that are available:

column
line
area
scatter
stacked column
stacked area
pie
donut
bubble
heatmap

To see a gallery of samples of some of these charts see the report gallery on our website.

You'll notice that the portfolio action has the largest spikes.

Add it to your dashboard

You can save a search from report mode just as you would any other search. When you save the search, add it to your default dashboard by checking the box at the bottom of the save dialog.

You'll see the report on the dashboard after clicking the logo to return to the home page. Dashboard searches are refreshed every tenth of the time interval (for example, a 4 hour search every 24 minutes) or every hour, whichever is shorter.

Note: You won't see your report on your dashboard if you haven't loaded any data to your main index yet. As soon as you have data in your main index, the "getting started" links are replaced with a default dashboard including modules that are predefined in the product, plus additional searches and reports you've added.

Previous: Alerting | Next: Using search commands

Comments

No comments have been submitted.