Recommendations for Custom Dashboards (Splunk)
uberAgent ships with more than 60 dashboards that visualize every metric uberAgent collects. So why create custom dashboards?
uberAgent’s dashboards need to work for all customers. They must be generic and cannot have dependencies on other apps.
The needs of our customers are as diverse as their networks. Custom dashboards meet the most specific requirements. They provide KPIs and views tailored to a customer’s needs. And custom dashboards can bring data from multiple sources together: uberAgent + X + Y. That is what Splunk calls operational intelligence.
Dashboards need to “live” somewhere. In Splunk, a dashboard’s natural habitat is an app. Apps are containers for dashboards and files. Apps allow you to:
- Keep related items in one place
- Add a corporate logo
- Assign permissions
- Publish to Splunkbase
At first, people are often tempted to store their custom dashboard files in the uberAgent app directory. That seems to be the easiest way, but it breaks easily when the uberAgent Splunk apps are updated. We recommend hosting custom dashboards in your own app, independent of uberAgent.
Networks are dynamic, as is uberAgent. New versions may bring new sourcetypes, data models, and fields.
uberAgent provides macros to simplify future upgrades. uberAgent’s macros can be used globally (e.g., in other apps, too). The use of the following macros is highly recommended:
uberAgent_index: stores the name of the uberAgent Splunk index
uA_DM_dataset: stores the name of the data model that contains a given dataset
All macros are defined in the file
macros.conf of the uberAgent Splunk dashboard app.
The best way to get to know the data collected and visualized by uberAgent is to look at the source code of the dashboards that ship with the product. We understand that practical examples can be very helpful and we explicitly recommend to reuse parts of the product’s default dashboards in your custom dashboards.