Important
Make sure to read the installation instructions. If you do no follow the instructions when you install the app you will not see anything in the dashboard. This app is not driven on live data but rather summarized data via scheduled reports. You will only see data from the point that you enable the shceduled searches going forward unless you use the backfill dashboard to create scripts to backfill the summarizations.
Installation Instructions
Standalone Environment
- Install the app.
- Enable the schedule for these saved searches.
- Summary Report Indexed Bytes
- Summary Report Indexed Bytes by index
- Summary Report Indexed Bytes by sourcetype
- Summary Report Indexed Count
- Summary Report Indexed Count by host
- Summary Report Indexed Count by index
- Summary Report Indexed Count by index host
- Summary Report Indexed Count by sourcetype
- Summary Report Indexed Count by sourcetype host
- Summary Report Windows EventCode Counts
- Summary Report Windows EventCode Counts by host
- Summary Report Summary Timings
- Every five minutes the summary report searches will run and start to populate the data for the dashboard. Since the dashboard relies on the summary report data you will not see anything actionable for at least a week. Many of the panels compare data over the last five weeks, so it will not be fully usable for at least 5 weeks. There is a secondary dashboard in the app called Backfill Generator that can be used to create shell scripts that will backfill the data so that the dashboard can be used sooner than five weeks.
- If you would like to only have the app scan a subset of your data you can edit the indexing_insights_indexes macro. By default the app will scan all the non-internal indexes.
- If you would like to specify which index the summarized data will be saved to you can edit the indexing_insights_summary_index macro. By default all the data is saved to the summary index.
Distributed Environment
- Install the app on a server for collecting the summary data.
- Enable the schedule for these saved searches. Make sure to only enable them on one Splunk server. I would suggest the license master.
- Summary Report Indexed Bytes
- Summary Report Indexed Bytes by index
- Summary Report Indexed Bytes by sourcetype
- Summary Report Indexed Count
- Summary Report Indexed Count by host
- Summary Report Indexed Count by index
- Summary Report Indexed Count by index host
- Summary Report Indexed Count by sourcetype
- Summary Report Indexed Count by sourcetype host
- Summary Report Windows EventCode Counts
- Summary Report Windows EventCode Counts by host
- Summary Report Summary Timings
- If you want to view the dashboard on another server, such as a search head, install the app there as well but do not enable the saved searches.
- Every five minutes the summary report searches will run and start to populate the data for the dashboard. Since the dashboard relies on the summary report data you will not see anything actionable for at least a week. Many of the panels compare data over the last five weeks, so it will not be fully usable for at least 5 weeks. There is a secondary dashboard in the app called Backfill Generator that can be used to create shell scripts that will backfill the data so that the dashboard can be used sooner than five weeks. I would suggest running the shell scripts on the same server where you enabled the saved searches.
- If you would like to only have the app scan a subset of your data you can edit the indexing_insights_indexes macro. By default the app will scan all the non-internal indexes.
- If you would like to specify which index the summarized data will be saved to you can edit the indexing_insights_summary_index macro. By default all the data is saved to the summary index.
Third Party Software
