Create views to monitor metrics in Splunk IAI

As a Splunk IAI administrator, you can create monitor views that display real-time metrics data for your assets. "Real-time" refers to a frequent refresh of the data displayed on the view, not a real-time search.

IAI users can review these monitor views to monitor and diagnose issues with industrial assets, ensure compliance, and plan predictive maintenance.

Create monitor views to accomplish any of the following goals:

• Create a real-time snapshot of industrial asset health and performance alongside related data that shows how overall operational efficiency affects uptime, maintenance schedule, shift changes, and so on.
• Create a summary view of all critical metrics for an asset so that IAI users can identify anomalies and drill down for further analysis.
• Visualize how a set of metrics are interrelated.
• Display metrics data together with other data, such as weather or financial data.
• Display metrics overlaid onto a meaningful custom image that provides context for your data, such as a plant layout.
• Allow IAI users to toggle between assets in the same group so they can view and compare metrics of similar assets in a single view.

To access monitor views, click the Monitor icon in the left sidebar of Splunk IAI.

Create a monitor view

You can create a monitor view for a group of assets or an operation.

Prerequisite

Decide whether you want to create a view for a group or an operation.

Data	Available for group views	Available for operation views
Asset metrics from all asset hierarchies linked to the operation.	Yes	Yes
Indexed data from your events index, such as alarms or other relevant contextual data.	Yes	Yes
Group metrics, which display the value for each asset in the group, depending on the asset the viewer selects from the list of assets in the group.	Yes	No

Create a monitor view for a group

1. From Splunk IAI, click the Browse icon and navigate to the group that you want to create a view for.
2. Click + Add View.
3. Type a Name and optional Description for your monitor view. The name of your monitor view must be unique. You cannot have two views with the same name, even if they are in different operations.
4. Click Add to open the monitor view editor.

Create a monitor view for an operation

1. From Splunk IAI, click the Monitor icon.
2. Make sure that the operation that you want to create a view for is selected in the menu in the upper left.
3. Click Add.
4. Type a Name and optional Description for your monitor view. The name of your monitor view must be unique. You cannot have two views with the same name, even if they are in different operations.
5. Click Add to open the monitor view editor.

Customize the content of a monitor view

Use the monitor view editor to customize the content that appears on a monitor view.

• Add metrics and other data to the monitor view canvas when editing. See Add content.
• Configure the widgets that display metric data to customize how they look and behave. See Configure metric widgets.
• Use the editing tools above the canvas to upload images, draw shapes, add icons, add text, and make connections that reflect the relationships between the components of your view. See Customize visualizations.

Add content

There are two kinds of data that you can add to monitor views: metrics data points and data from event indexes. Find the data points that you want to add in the panel to the left of the monitor view canvas.

1. Open the monitor view editor.
2. Use the Asset Metrics tab to find the metrics you want to add.
   • In a monitor view for an operation, you have access to all asset metrics in the operation, including metrics that assets inherit from their groups.
   • In a monitor view for a group, you have access to all asset metrics in the operation, and you have access to group metrics in the Group Metrics tab. This includes both raw metrics inherited from group members and calculated metrics for the group.
3. Click and drag metrics to the canvas to create a metric widget.
4. Click Save.

Metrics that have alerts configured display green, yellow, or red on the monitor view. The colors are based on the severity and thresholds that you configured in the alert and the latest value of the metric. See Set alerts on metrics in Splunk IAI.

In a monitor view for a group, any group metrics included in the view display their values for one asset at a time. When editing or viewing the monitor view, use the Select Asset drop-down menu to display values for a different asset in the group. If you choose an asset for which the metric is not relevant, the widget displays a message that says, "This metric is not available for the selected asset."

To add non-metric data to your monitor view, follow these steps in the monitor view editor:

1. Click Other to search for data in your event indexes. This data can be event data that is associated with your assets, or environmental data such as weather data, stock prices, and so on, that provide context or supplementary information related to your metrics data points in your monitor views.
2. Specify an index to search. You can narrow your search by source type and keyword. The search returns a list of fields that match your criteria.
3. Click a field to make its value appear in your monitor view.
4. Click Save.

If you don't have the data you need in your indexes, work with your Splunk administrator to get data in to Splunk Enterprise.

Configure metric widgets

You can change the look and behavior of a selected metric widget by using the Configurations panel to the right of the canvas.

1. Open the monitor view editor.
2. In the canvas, click on a metric widget you would like to edit.
3. To lock or unlock the widget position on the canvas, click the Position lock icon.
4. To control how the widget layers with other elements, click the Layer buttons.
5. To modify the size of the widget, adjust the Width and Height fields or drag a corner of the widget in the canvas to resize by hand.
6. To change the label for the widget, type a new label in the Label field and adjust the color, font, font size, and location relative to your metric widget.
7. To remove the label for the widget, set Label Box to Off.
8. Change the background color of the widget by selecting a color from the color wheel, typing a hex code for a color, or typing None to make it transparent.
9. Toggle the abbreviation for your metric on or off.
10. Adjust the number of significant digits shown for your metric using the Digit Precision drop-down menu.
11. Change the search frequency for your metric to control how quickly the metric refreshes. The default is one minute.
12. To customize what happens when a user clicks on a widget for more details, click On next to Custom Drilldown. By default, clicking on a widget sends the user to a search for that metric or other data point. You can customize this behavior to send the user to the following other locations:
    • Another monitor view that you specify.
    • A Splunk dashboard that you specify.
    • The Analyze view for that metric. This option is only available for metrics.
    • A custom URL that you specify, beginning with http:// or https://.
13. For Viz Type, select an appropriate option to display your metric. Visualization types include single value, gauge, single value with sparkline, and single value with delta. Single value delta and single value with sparkline widgets contain a trend number calculated over the past hour. For single value with sparkline, this time window is configurable using the Time Window drop-down menu, which appears only after you select the single value with sparkline Viz Type.

Customize visualizations

Use the editing toolbar along the top of the canvas to customize your visualization with shapes, icons, and other elements.

You can upload a background image to overlay your metric data on a diagram of your choice. Supported image types are PNG, JPG/JPEG, and GIF.

Splunk IAI lets you upload custom icons to design monitor views based on your organization's standards. Only .svg files are supported. You can create multiple icon categories to manage different families of icons. After you create a category and upload icons, these icons are available to all operations.

1. In the toolbar above the canvas in the monitor view editor, click the Icon button.
2. Click + New Category.
3. Type a category name. Category names cannot include special characters.
4. Drop your files or click browse... to select .svg files. You can upload multiple files at once.
5. In the New Category window, click on individual icon names to rename them. You cannot have two icons with the same name. Click the X on an icon to delete it.
6. When you are satisfied with your icons and names, click Save. The new icon category appears with the others in the Select icon window.

After you create an icon category, you can add more icons to it by clicking the pencil icon beside the category name.

Troubleshoot monitor views

The following issues can occur when viewing and editing monitor views.

Widget shows "N/A"

There are several reasons why a widget might display "N/A":

• If the currently logged-in user does not have permission to view a widget in a monitor view, the widget displays as a grey box with "N/A" inside it. Read access to metrics data is controlled by which indexes a user has permission to search. Contact your Splunk administrator to adjust these permissions.
• If the metric is a calculated metric, and the formula or time interval causes the metric to be invalid, the widget displays as a grey box with "N/A" inside it. Check that the time interval is set to at least the frequency of the data collection, and that the metric is able to display time series data on the Analyze page.

Widget shows "This metric is not available."

A widget shows the message "This metric is not available." in the following circumstances:

• You use a raw or calculated metric for an asset in a view, and then later unlink or delete the asset hierarchy that contains the asset to which that metric pertains.
• You use a calculated metric in a view for an operation, and then later delete this calculated metric or delete a calculated metric that is a component of the formula of this calculated metric. If the underlying search for the calculated metric is still valid, the widget continues to show a value.
• The number of asset metrics or group metrics in your operation exceeds 2,000.
• The number of data results returned by a search on the Other tab exceeds 2,000.

Widget shows "This metric is not available for the selected asset."

A widget shows the message "This metric is not available for the selected asset." in the following circumstances:

• The metric does not apply to the asset selected in the Select Asset drop-down menu.
• You use a calculated metric in a group view, and then later delete the calculated metric.

Widget shows "Invalid Search or missing fields required for thresholding"

A widget shows the message "Invalid Search or missing fields required for thresholding" in circumstances when the search driving the metric is not valid. For example, if you try to display a calculated metric on a group view but the underlying components of the calculated metric pertain to assets not in that group, the search is invalid.

Widget color does not match what I set in my alert

The colors applied to metric widgets are determined by thresholds configured in alerts. See Set alerts on metrics in Splunk IAI. When there are multiple alerts on a metric with different severity thresholds, the severity displayed for the metric is determined according to the following alert precedence:

• Alerts set for an individual asset take precedence over alerts set at the group level.
• Alerts set earlier take precedence over alerts set later.

Edit a monitor view

As an IAI administrator, you can edit all monitor views.

1. Click the Monitor icon.
2. Find the monitor view that you want to edit in the list and click Edit.

You can also click the Edit button in the top right corner of the page while viewing any monitor view from the Monitor page.

Delete a monitor view

As an IAI administrator, you can delete monitor views.

1. Click the Monitor icon.
2. Find the monitor view that you want to delete in the list and click Delete.

You can also click the Delete View button in the top right corner of the view area while viewing any monitor view.