Visualize any Splunk data

Splunk is a leading platform for searching, monitoring, and analyzing machine-generated data from various sources in real-time. Known for its ability to handle massive amounts of data, Splunk helps organizations transform logs, metrics, and events into valuable insights, making it an essential tool for IT, security, and business operations.

Whether you're monitoring system performance, tracking security events, or analyzing user behavior, a well-designed Splunk dashboard can transform complex data sets into clear, visual stories that help teams respond faster and more effectively. Today we’ll explore how to leverage the power of the SquaredUp Splunk plugin to create a Splunk dashboard.

Dashboard preview

Dashboard walkthrough

The top 3 donut tiles are made using Splunk reports. Splunk reports are pre-configured searches that are saved in Splunk to retrieve and display data quickly.

All of the other tiles are running the actual Splunk queries. The bar graph on the top right runs the following query to get the size of all Index databases.

| REST /services/data/indexes | table title currentDBSizeMB

In the tiles following, we've got a couple of line graphs that plot metrics like Index Write Throughput MB and Data Ingestion by Hosts etc.

Lastly, the table displays all the services that are installed on the servers that are connected to Splunk using the following query.

index="main" sourcetype=WinEventLog:Security (EventCode=4697 OR EventCode=601)
| eval Date=strftime(_time, "%Y/%m/%d")
| rex field=Message "Service Name:\s+(?<Service_Name>\S+)"
| eval Status=coalesce(Keywords, Type)
| table _time, EventCode, Status, Service_Name, ComputerName, LogName

Get the dashboard

1. Create a free SquaredUp account

2. Add the Splunk dashboard plugin

3. Paste the scripts in and start dashboarding!

To see what other dashboards you can create, check out our Dashboard Gallery.