Reports are basically saved searches that you can access by clicking a link. They can be referenced by dashboards in order to create specific panels, and you can accelerate their performance with Splunk's acceleration option. You cannot accelerate a dashboard without leveraging a report or a data model of some sort. Reports are individual searches that populate results into a single panel.

I'll start by using one of the most common report examples for an operations infrastructure team, the disk space utilization report. I'm going to use Linux-based systems for my example. This example will assume that you have the Splunk_TA_nix add-on installed across your entire Linux environment.

Finding the information we are looking for is as simple as looking at our common command outputs for df. In Splunk, the root search starts with this data:

index=os sourcetype=df 

This in turn gives us the events of our df output:

If our deployment was successful at the search tier, indexing tier, and forwarding tier, the fields that we will need to use for this example will be auto-extracted.

Here we will be averaging the used space by mount on every mount within our environment, and which host they live on:

index=nix sourcetype=df  
| stats avg(PercentUsedSpace) AS pctSpace by mount host 
| eval pctSpace=round(pctSpace) 

And then we will add a filter to it, to create relevance to people:

index=nix sourcetype=df  
| stats avg(PercentUsedSpace) AS pctSpace by mount host 
| eval pctSpace=round(pctSpace) 
| where pctSpace > 90 
| sort - pctSpace 

This will give us a visualization that looks something like this:

Be aware of what you set your time range to, as the report is quite dependent on this. If you want this to run once a day, then set the time range picker to 24 hours.

Once we have that search, we simply click on the Save As feature:

Click Report, and pick a name for this report:

To view this report, simply go to the Reports menu:

And select your newly saved report to have it populate for you through your time range:

From here, you have the option to export, print, or embed these reports, or even send them manually to a person or group of people.

A report is not meant to be triggered in an automated fashion, as this is part of the alert functionality in Splunk.

From here, we can accelerate these reports. Report acceleration is helpful when attempting to get large sets of results to return faster, as it summarizes the data and stores it in virtual memory. We do this by clicking on the Edit function, and clicking Edit Acceleration:

We will then need to choose how long we want the historical data to show, which in this case is a 1 Day period, and click Save.

If we choose, we can then stick these reports in a dashboard, and start off with a good, fast-loading panel.

Dashboards are the culmination of all of the previous things we've discussed concerning knowledge objects, search queries, and reports. These are the things that everybody loves, and truly provide the most value to your user base when made correctly. In short, a dashboard is a collection of searches and/or reports framed inside HTML in different panels.

Dashboarding can be an art form in itself; however, I'm going to suggest that we stick to the basics until people start seeing the value in the Splunk product. Most of what you will need can be downloaded and pulled from the Dashboard Examples app; these are some of the techniques that we will be talking about here in this chapter.

The link to this app is here: https://splunkbase.splunk.com/app/1603/ .

There are a few different types of dashboard to be aware of.