notes.md

Splunk Dashboard Training

Splunk Dashboard types

• Static

• Dynamic

Need to create own index - Settings > Indexes - add - pclark_internal - default value

creating index and uploading data manually

Dashboards

Create search with visualization, save as dashboard, classic.

You can then add additional panels with new searches by saving to existing.

New indexes

Webapp_data server_security

Same same dashboard, add new section,

index called server_secure

Create Panel called secure monitor Descending order: count rhost who failed login