Splunk Cloud Platform

Splunk Cloud Platform Admin Manual

This documentation does not apply to the most recent version of Splunk Cloud Platform. For documentation on the most recent version, go to the latest release.

Review the Overview (preview) dashboard

Get a summary of your deployment's most important metrics using the Cloud Monitoring Console (CMC) Overview (preview) dashboard.

Preview features are provided by Splunk to you "as is" without any warranties, maintenance and support, or service level commitments. Splunk makes this preview feature available in its sole discretion and may discontinue it at any time. Use of preview features is subject to the Splunk General Terms.

Do not modify this dashboard. Changing any of the search criteria, formatting, or layouts might cause inaccurate results and also override the automatic update process. You can use the Personalize feature to select which metrics to display.

Access the Overview (preview) dashboard

In CMC version 3.25.0, Splunk reimagined the Overview dashboard so you can prioritize important metrics.

  1. In Splunk Web, select Cloud Monitoring Console.
  2. Then, select Overview.
  3. Select the Overview dashboard link in the banner.

Review the Overview (preview) dashboard metrics

In the Overview (preview) dashboard in CMC version 3.25.0, you can prioritize metrics and personalize your experience by choosing which license entitlement and status metrics to display.

Review the dashboard to get fast access to these metrics:

  • View your usage levels with the status indicators displayed in each license entitlement metric.
  • Refresh or open any of the metrics directly in the Search and Reporting app.
  • Select Personalize to choose which metric panels to display and prioritize your top metrics. Your selection applies to your own view. Other dashboard users can make their own selections.

See the following table to learn about each metric that you can select from the Overview (preview) dashboard:

Panel Description

Overall · Peak SVC Usage

Displayed by default if your deployment has this entitlement.

Shows your organization's overall peak Splunk Virtual Compute (SVC) usage as a single value and a percentage of your license entitlement.

Overall peak SVC usage refers to the highest amount of resources used in a given time interval to perform system processes such as indexing, any running search processes, and shared services. It primarily measures the CPU usage across search and indexing workloads.

Ingest

Displayed by default if your deployment has this entitlement.

Shows ingest license entitlement and usage data if the deployment has an ingest-based subscription.

This panel accesses the Ingest daashboard. See Monitor current usage of your ingestion-based subscription.

Search count

Displayed by default.

The large number shows the number of searches performed during the previous day. For example, if you access the dashboard on June 8, this panel shows data from June 7, 12:00 AM to 11:59 PM. The smaller number and arrow indicates the increase or decrease in searches from the previous search count.


This panel accesses the Search usage statistics dashboard. See search usage statistics Documentation:SplunkCloud:Admin:MonitoringSearch.

Total ingest volume

Displayed by default.

The large number shows the amount of data ingested in GB in the previous day. The smaller number and arrow indicates the increase or decrease in data ingestion from the previous ingestion total.

This panel accesses the Ingest dashboard. See Monitor current usage of your ingest-based subscription.

Missing forwarders

Displayed by default.

A forwarder shows a status of missing if it hasn't connected to indexers within 15 minutes of its last successful connection.

This panel accesses the Forwarders: Deployment dashboard. See Monitor forwarder deployments.

Searchable storage (DDAS)

Displayed by default if your deployment has this entitlement.

Shows deployment's searchable storage entitlement based on DDAS license and amount of searchable storage used by customer and metered internal indexes

This panel accesses the Searchable storage (DDAS) dashboard. See Monitor current usage of Searchable Storage.

Archive storage summary (DDAA)

Displayed by default if your deployment has this entitlement.

Shows deployment's archive storage entitlement based on DDAA license and amount of archive storage used by customer and metered internal indexes.

This panel accesses the Archive storage (DDAA) dashboard. See Monitor current usage of Archive Storage.

Federated search for Amazon S3

Displayed by default if your deployment has this entitlement.

Shows amount of data scanning capabilities and percentage of data scanning capabilities utilized by searches during current license term.

This panel accesses the Federated Search for Amazon S3 dashboard. See Monitor your Federated Search for Amazon S3 resources.

Total indexes

Shows a snapshot of the currently active indexes that contain events.

This panel accesses the Indexing performance dashboard. See Check indexing performance.

You must have the indexes_edit capability to view accurate data in this panel.

Indexes with events

Shows the number of indexes that have processed events.

This panel accesses the Indexing performance dashboard. See Check indexing performance.

You must have the indexes_edit capability to view accurate data in this panel.

Data parsing issues

Shows a single value of the line breaking, timestamp parsing, and aggregation issues the Splunk platform encountered when parsing your data for indexing.

This panel accesses the Data quality dashboard.

Splunk TCP port closures

Shows the percentage of your active indexers in the last 4 hours that have Splunk TCP port closures. For example, if you access the dashboard at 4:00 PM, this panel shows data from 12:00 through 4:00 PM.

This panel accesses the Indexing performance dashboard. See Check indexing performance.

Scheduled skipped searches

Shows the percentage of your scheduled searches that encountered an issue and had to be skipped in the last hour.

This panel accesses the Skipped scheduled searches dashboard. See Investigate skipped scheduled searches.

Long running searches

Shows the number of ad hoc searches in the last 4 hours that have taken more than 30 minutes to complete.

This panel accesses the Search Usage Statistics dashboardAnalyze search usage statistics.

Interpret these results

Because the Overview (preview) dashboard provides a high-level view of the overall health of your deployment, investigate any anomalous spikes or dips and take the necessary mitigation action. For example, if you see a sudden increase in skipped scheduled searches, audit these searches to determine the cause and correct any issues.

See Use the Health dashboard to further investigate and learn more about the overall health of your deployment and its data collection, indexing, and search performance.

Last modified on 28 June, 2024
Use the Overview dashboard   Use the Health dashboard

This documentation applies to the following versions of Splunk Cloud Platform: 8.2.2112, 8.2.2201, 8.2.2202, 8.2.2203, 9.0.2205, 9.0.2208, 9.0.2209, 9.0.2303, 9.0.2305, 9.1.2308, 9.1.2312, 9.2.2403 (latest FedRAMP release)


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters