Documentation:
3.3.2
This page last updated: 10/20/08 09:10am
About Splunk Web
Splunk Web is Splunk's dynamic and interactive graphical user interface. It runs off of the splunkweb process, which is a Python-based application server. Use Splunk Web to search your IT data and manage your Splunk deployment. Access Splunk Web via a Web browser. Refer to the system requirements for our list of supported operating systems and browsers.
Splunk Web contains the search bar, dashboards, and configuration pages. You can run a custom search from any of the dashboards. Access the Preferences panel and the Admin pages with links on the top right corner of the dashboards, above the search bar. Access different dashboards from a drop-down menu located under the search bar and on the right.
DashboardsDashboards are customizable pages in Splunk Web. You can add and remove components to and from each dashboard. These components may be lists of all indexed data, snapshots of different saved searches, or a list of saved searches.
Splunk ships with three default dashboards: getting started, main, and admin.
Getting started dashboardThe getting started dashboard is the default landing page for Splunk Web. It provides information and links to help new users learn how to use Splunk. There are many upcoming changes to the getting started dashboard.
In 3.3, the buttons for indexing data take you to the index manager:
- Clicking Index Files redirects you to the Admin > Data Inputs: Files & Directories: New Input page. You can enter Source, Host, and Source Type information to define local or remote files and directories to index.
- Clicking Index More Data redirects you to the Admin > Data Inputs: All page. You can select the type data to configure and add to your inputs.
Read more about the index manager and adding inputs.
Main dashboardThe main dashboard provides default modules, which include:
- Lists of all indexed data, sorted by Sources, Sourcetypes, and Hosts.
- A timeline of errors in the last hour.
- A list of saved searches.
The admin dashboard provides charts that report information a Splunk administrator may find useful:
- Messages by minute in the last 3 hours.
- The volume of data (KB/hr) over the last 24 hours.
- The number of Splunk errors over the last 24 hours.
- The daily indexing volume by server.
Instead of editing the default dashboards, we recommend creating a new dashboard to customize.
- From the dashboard drop-down menu, select create new dashboard... to name your new dashboard and add it to Splunk Web.
- Use the Edit options, located next to the drop-down menu, to select the saved searches or reports you want to add to a dashboard.
- Use the Delete option, located next to the drop-down menu, to remove one or more dashboard from Splunk Web.
You can customize the layout of your dashboard by editing prefs.conf. Refer to the Developer Manual for Customized Dashboard examples.
PreferencesUse the Preferences panel to configure Splunk Web's default search properties and general appearance and behavior. For more information, read Change Splunk Web preferences.
SearchUse the Search preferences tab to define:
- The default time range; You can always change the timerange from the dashboard.
- A maximum limit for the number of events Splunk indexes when you search.
- How Splunk Web handles segmentation.
Note: Splunk Web's segmentation setting affects how the browser interacts with Splunk and may speed up the display of search results. This setting should not be confused with indexing segmentation.
GeneralUse the General preferences tab to define:
- A default theme for Splunk Web. If you want to customize Splunk Web's appearance, refer to the Developer manual.
- Click behavior. You can click on sections of your search results to add or replace terms in your search. "Click behavior" configures either ctrl or ctrl-click to add and replace when narrowing your search.
In 3.3, when you click on the Admin link, to the top right of the page, the Server settings page opens. Instead of navigating a tabbed menu layout, you now access the Admin pages from a list located on the left side of the page. Click on the top-level section names to view the pages included in that section. You have access to the same pages as before (Server, Data Inputs, Distributed, Users, Saved Searches, and License & Usage) with the addition of Indexes and Applications.
ServerUse the Admin > Server pages to view and change server settings, restart the Splunk server, and change and reload Splunk's authentication method. Read more About Splunk server's settings and changing Splunk server's settings.
Data InputsUse the Admin > Data Inputs pages to add new and edit existing inputs in Splunk Web. You can view and manage all of your files and directories, FIFO queues, network ports, and crawls from this page. Read more About Inputs and using the Data Inputs page to add inputs.
IndexesUse the Admin > Indexes pages to view a list of your indexes, edit individual index properties, and add new indexes. Read more About Indexes.
ApplicationsUse the Admin > Applications pages to manage existing applications and browse SplunkBase for new applications to install. Read more About Applications.
DistributedUse the Admin > Distributed pages to view your network topology and configure search distribution, data forwarding, and data receiving between multiple Splunk instances. Read more About Data Distribution.
Note: You can only set up forwarding from this page if you are running Splunk with a Free license. To configure distributed search and data receiving, you must have an Enterprise license.
UsersUse the Admin > Users page to view a list of users and their search history, edit each user's properties, and add new users. Read more about Users and User Roles.
Note: You cannot access this page if you are running Splunk with a Free license; you must have an Enterprise license to modify user's properties.
Saved SearchesUse the Admin > Saved Searches page to view a list of your saved searches and edit their properties, create new searches, or delete existing searches. Read more about Managing saved searches.
License & UsageUse the Admin > Licenses & Usage pages to view view your current license and replace it with a new one. This page displays the type of license you're running, the maximum indexing volume allowed, and when the license expires. This page also provides some useful statistics, such as: number of days before you need to renew, the peak usage in GB/day, and peak percentage. Read more About Licenses.
Comments
No comments have been submitted.