Splunk Observability Cloud metrics in Splunk Cloud Platform

There are two ways to view observability metrics from Splunk Observability Cloud in Splunk Cloud Platform:

• Create an observability metrics-based chart in Splunk Dashboard Studio
• Import a chart from Splunk Observability Cloud into Splunk Dashboard Studio

Prerequisites

To view Splunk Observability Cloud metrics in Splunk Cloud Platform, you must pair your Splunk Cloud Platform organization and your Splunk Observability Cloud organization. There are 2 ways to pair:

• Set up Unified Identity
• Add an observability API access token

We recommend pairing through Unified Identity. To see if your organization meets the requirements to use Unified Identity, see Who can access Single Sign On (SSO) and the benefits of Unified Identity? If your organization can pair through Unified Identity, follow the instructions in How to set up Unified Identity to pair.

If your organization cannot pair through Unified Identity, you can pair by adding an observability API access token. Follow the instructions in Access tokens to pair.

If you have Unified Identity configured between your Splunk Cloud Platform stack and an Observability Cloud organization, you do not need to add an observability API access token. The observability metrics in Dashboard Studio default to On. When observability metrics default to On, any observability metric-based chart with a Global Time Range set to "Last <value> <minutes/hours/days>" receives data and streams values into the chart.

Check for observability capabilities

To see observability data in dashboards, you need the read_o11y_content capability. To add charts with observability content, you need the write_o11y_content capability. You can check if your role has these observability capabilities by following these steps:

1. Navigate to the Settings drop-down list.
2. Under Users and Authentication, select Roles.
3. Under the Name column, find the role you want to check.
4. Navigate to the Actions column associated with that role, and select the Edit drop-down list.
5. Select View Capabilities. The View Capabilities modal will pop up.
6. In the search bar, filter for read_o11y_content or write_o11y_content.

Deactivate the observability functionality

The feature flag for the observability functionality is called activate_o11y_dashboards and located in your web-features.conf file. The flag defaults to True. You can deactivate the observability functionality by setting the feature flag to False. If the feature flag is set to False after you've added observability content to a dashboard, an error message appears on any charts using observability content. To change the feature flag setting, contact your support team. For more details, see Contact Support in the Troubleshooting Manual.

Create an observability metrics-based chart in Dashboard Studio

To create a chart based on observability metrics in Splunk Cloud Platform, follow these steps:

1. Navigate to the dashboard where you want to add a metrics-based chart or create a new dashboard. See Splunk Dashboard Studio Part 2: Create a dashboard to learn how.
2. Select the add chart icon () in the editing toolbar, then select the chart type you want to use.
3. In the Select data source panel, select O11y Metric Search, then select + Create o11y metric search.
4. Give your new data source a name in the Data source name field.
5. In the Metric field, enter the first few letters of the observability metric you want to analyze, then select the metric when it appears in the drop-down list.
6. Select Filter, select a dimension, then add the values you want to filter by.
7. Select Analytics, select + Add Analytics, then select the analytics type you want from the options Count, Sum, Mean, Max, or Min. Select the value or values you want to use.
   1. To create a chart with multiple metrics, you can construct and import a chart from Splunk Observability Cloud. For more details, see the following section Import a Splunk Observability Cloud chart into Dashboard Studio.
8. Select Apply Analytics.
9. Select the time range you want your chart to track.
10. Select Apply and close.

Suggested chart types for observability metrics

You can use all Dashboard Studio chart types with observability metrics, but some charts are better suited for the structure of observability data. The following charts are particularly effective in handling observability data:

• Area
• Column
• Line
• Single value
• Table

Import a Splunk Observability Cloud chart into Dashboard Studio

To import a Splunk Observability Cloud chart into Dashboard Studio, follow these steps:

1. Navigate to the Splunk Observability Cloud chart that you want to import into Dashboard Studio. Select the More menu, then select Open. Do not select Copy from the More menu drop-down list because it is a temporary URL.
2. Copy the URL of the chart from the address bar.
3. Navigate to the Splunk Cloud Platform dashboard where you want to add a metrics-based chart or create a new dashboard. See Splunk Dashboard Studio Part 2: Create a dashboard to learn how.
4. Select Edit in the upper right corner, then select the Import content icon (). The Import content panel opens on the right.
5. In the Import content panel, paste the URL of the Splunk Observability Cloud chart you want to import in the Content URL field.

Limitations

• Observability metrics in Dashboard Studio do not support creating chain searches from observability metrics.
• Observability metrics in Dashboard Studio do not support the Open in Search feature.
• Observability metrics in Dashboard Studio do not support observability data sources as token values. However, you can use tokens to filter observability metric data sources.