Dashboards and Visualizations - Make Data Shine

In this chapter, we will learn how to build dashboards and create visualizations of your data. We will cover the following recipes:

• Creating an Operational Intelligence dashboard
• Using a pie chart to show the most accessed web pages
• Displaying the unique number of visitors
• Using a gauge to display the number of errors
• Charting the number of method requests by type and host
• Creating a timechart of method requests, views, and response times
• Using a scatter chart to identify discrete requests by size and response time
• Creating an area chart of the application's functional statistics
• Using metrics data and a trellis layout to monitor physical environment operating conditions
• Using a bar chart to show the average amount spent by category
• Creating a line chart of item views and purchases over time

...

Introduction

In the previous chapter, we learned all about Splunk's Search Processing Language (SPL) and how it can be leveraged to search and report your data. In this chapter, we're going to build on this knowledge and use some of Splunk's visualization capabilities to make our data shine! You will learn how to create a dashboard through the Splunk UI and proceed to add the reports that were built in the previous chapter to it. Two more dashboards will then be created as a result of the remaining recipes.

Visualizations are a cornerstone for proper data presentation. By visualizing data in a manner that we as humans are accustomed to, you enable the user to better relate to what is being presented and have a proper understanding of how to react. When using Splunk for Operational Intelligence, you will be hard pressed to find a report that is not being visually...

Creating an Operational Intelligence dashboard

Before this chapter gets into everything that is great about visualizations, it is best to first cover the process of creating a dashboard. In this recipe, you will create a dashboard from scratch using the Splunk Web UI which we will then use for other recipes in this chapter.

Getting ready

To step through this recipe, you will need a running Splunk Enterprise server, with the sample data loaded from Chapter 1, Play Time - Getting Data In, and to have completed all of the recipes from Chapter 2, Diving into Data - Search and Report. You should be familiar with navigating the Splunk user interface.

...

Using a pie chart to show the most accessed web pages

The sample data loaded in Chapter 1, Play Time - Getting Data In, provides a wealth of information on how customers are interacting with our online shopping website. In the Finding the most accessed web pages recipe in Chapter 2, Diving into Data - Search and Report, we saw how to find the most accessed web pages. The output of that recipe was displayed in a tabular format that could be hard for the viewer to grasp the proportional differences between web page access amounts. We will now take a look at how to use pie charts. By taking the same data and visually presenting it using a pie chart now, we will enable the viewer to more easily identify the proportion of requests between different web pages. Visual representation of data, even if the data is very simple, can lead to better decision making in times of need.

In this...

Displaying the unique number of visitors

It is always good to understand the number of page views and those that are accessed most, but sometimes, it is even better to understand how many of these page views are from unique visitors. Through the web access logs, we can get an understanding of how many unique visitors we have had to our website. For example, it could be helpful to understand whether times of high load are due to the true number of sessions on the website.

In this recipe, you will write a Splunk search to find the unique number of visitors to the website over a given period of time. You will then graphically display this value on a dashboard using the single value visualization.

Getting ready

To step through...

Using a gauge to display the number of errors

Not every user interaction with a website will go smoothly. There are times when accessed pages will report an unsuccessful status code. Understanding this number and being able to apply acceptable low, medium, and high thresholds enables a better understanding of the current user experience when there are a higher number of errors than acceptable.

In this recipe, you will write a Splunk search to find the total number of errors over a given period of time. You will then graphically represent this value on the dashboard using a radial gauge.

Getting ready

To step through this recipe, you will need a running Splunk Enterprise server, with the sample data loaded from Chapter 1, Play...

Charting the number of method requests by type and host

In our environment, where multiple hosts are responding to web requests for customers who browse the website, it is good to get an idea of the current number of each method request split by the host. Methods relate to request/response actions between a customer's web client and our web hosts. Having this type of information can enable you to understand if these requests are properly being balanced across the hosts, or if one host is receiving the majority of the load.

In this recipe, you will write a Splunk search to chart the number of method requests split by type and host. You will then graphically represent these values on a dashboard using a column chart.

Getting ready

...

Creating a timechart of method requests, views, and response times

Having the right single values displayed on a dashboard can be beneficial to understanding key metrics, but can also be limiting in providing true operational intelligence on how different metrics of our website affect one another. By plotting values such as the number of method requests, number of total views, and average response times over a given time range, you can begin to understand if there is any correlation between these numbers. This can be very beneficial in understanding things such as if the average response time of pages is growing due to the number of active POST requests to the website or if one type of request is making up for the majority of the total number of requests at that given time.

In this recipe, you will create a Splunk search using the timechart command to plot values over a given...

Using a scatter chart to identify discrete requests by size and response time

As shown by the recipes up until this point, there is vast intelligence that can be attained by building visualizations that summarize the current application state, analyze performance data over time, or compare values to one another. However, what about those discrete events that appear off in the distance at odd or random times? These events might not be correctly reflected when looking at a column chart, single value gauge, or pie chart, as to most calculations, they are just a blip in the radar somewhere off in the distance. However, there could be times where these discrete events are indicative of an issue or simply the start of one.

In this recipe, you will write a very simple Splunk search to plot a few elements of web request data in the tabular format. The real power comes next where you will...

Creating an area chart of the application's functional statistics

Understanding not only how your web page is performing and responding to requests, but also how underlying applications that you rely on are performing is critical to the success of any website. You need to have the constant pulse of how the application is behaving and if any trends are emerging or correlations are being observed between interdependent pieces of data. The experience a customer has with your website is reliant on the constant high performance of all of its components.

In this recipe, you will write a Splunk search using the timechart command to plot web application memory and response time statistics over a given time period. You will then graphically present these values using an area chart.

Getting...

Using metrics data and a trellis layout to monitor physical environment operating conditions

A lesser known element that can affect server, and ultimately website, performance are the conditions within the physical rooms where the servers reside. Poor operating environment conditions such as high humidity and temperature can lead to server failure or automatic safeguards invoked to shutdown servers to protect against total failure, thus impacting website performance and availability. Therefore, it is greatly beneficial to monitor all aspects of the physical operating environment, not just the server itself but the physical conditions it is subjected to.

In this recipe, you will write a Splunk search leveraging the new metrics data type index and mstats command to illustrate the trends of humidity and temperature values for the web servers. You will then graphically present this...

Using a bar chart to show the average amount spent by category

Throughout this chapter, you have been building visualizations to provide insight into the operational performance of our e-commerce website. It can also be useful to understand the customer's view and the factors that might drive them to the website. This type of information is traditionally most useful for product or marketing folks. However, it can also be useful to gain an understanding of whether an item is increasing in popularity and/or if this could ultimately lead to additional customers and heavier load on the site.

In this recipe, you will write a Splunk search to calculate the average amount of money spent, split out by product category. You will then graphically present this data using a bar chart on a new Product Monitoring dashboard.

...

Creating a line chart of item views and purchases over time

Continuing on from the last recipe, you will look to further improve your understanding of customer activities by now looking at a chart of item views and actual purchases over a given time period. This will allow you to understand if customers who are viewing an item actually follow through with purchasing the given item.

In the last recipe of this chapter, you will write a Splunk search to chart item views and purchases over a given time period. You will then graphically present this data using a line chart.

Getting ready

To step through this recipe, you will need a running Splunk Enterprise server, with the sample data loaded from Chapter 1, Play Time - Getting...