From the course: Practical Splunk: Build Data Intelligence through SPL, Reports, and Dashboards

Unlock this course with a free trial

Join today to access over 24,900 courses taught by industry experts.

Using data sources

Using data sources - Splunk Tutorial

From the course: Practical Splunk: Build Data Intelligence through SPL, Reports, and Dashboards

Start my 1-month free trial Buy for my team

Using data sources

“

- Welcome to the lesson, Using Data Sources. What are data sources? Data sources are the components that power the panels of a dashboard. We have already seen one in action. The most common data source is the search query. We have been powering all of our panels using this type of data source, which is a search data source. You can also use a saved search, also known as a report to power the panel of a dashboard. Using a report to power the panel of a dashboard has many advantages, the most significant of which is the performance. If a report is scheduled and used as a dashboard panel, when the dashboard is loaded, an ad hoc search is not kicked off. Instead, the results from the last run of the scheduled research is simply loaded. The dashboard will load instantaneously with the data. In addition, using data sources, you can also chain multiple searches to improve performance. We will actually see an example of chained search in the demo. Finally, you can add secondary data sources…

Contents