Skip to content

Commit 89856ed

Browse files
dveuvedveuve
committed
New dashboards for app
1 parent 67388ea commit 89856ed

File tree

7 files changed

+330
-1
lines changed

7 files changed

+330
-1
lines changed

‎app/appserver/static/img/slide-splunk-databricks-integration.png

509 KB
Loading

‎app/default/data/ui/nav/default.xml

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
<nav search_view="search" color="#1B3139">
2+
<view name="databricks-intro" default="true" />
23
<view name="configuration"/>
34
<view name="databricks_job_execution_details"/>
5+
<view name="databricks-sample-dashboard" />
6+
<view name="databricks-launch-notebook" />
47
<view name="search" label="Search"/>
5-
</nav>
8+
</nav>

‎app/default/data/ui/views/databricks-intro.xml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
<dashboard>
2+
<label>Intro</label>
3+
<row>
4+
<panel>
5+
<title>Overview</title>
6+
<html>
7+
<img style="float: right;" src="/splunkd/__raw/servicesNS/nobody/TA-Databricks/static/appIconAlt_2x.png"></img>
8+
<p>The Databricks Add-on for Splunk allows Splunk teams to take advantage of the effective cost model of Databricks along with the power of AI without asking users to leave the comforts of their Splunk interface.
9+
</p>
10+
<p>Users can run ad-hoc queries against Databricks from within a Splunk dashboard or search bar with the add-on. Those who have notebooks or jobs in Databricks can launch them through a Splunk dashboard or in response to a Splunk search. The Databricks integration is also bi-directional, letting customers summarize noisy data or run detections in Databricks that show up in Splunk Enterprise Security. Customers can even run Splunk searches from within a Databricks notebook so that they don’t need to duplicate all of their data to get the job done.</p>
11+
<p>The Splunk and Databricks integration allows customers to reduce their cost, expand the data sources they analyze, and provide the results of a more robust analytics engine, all without changing the tools used all day by their staff.</p>
12+
13+
</html>
14+
</panel>
15+
</row>
16+
<row>
17+
<panel>
18+
<title>Integration Points</title>
19+
<html>
20+
<div>
21+
<img style="width: 100%; max-width: 1496px !important;" src="/static/app/TA-Databricks/img/slide-splunk-databricks-integration.png" title="Screenshot of slide showing the integration methods" ></img>
22+
</div>
23+
<p>There are three main integration points, as shown in the slide above:</p>
24+
<ol>
25+
<li>This app enables running queries from Splunk against Databricks by configuring a personal access token for a service account within Databricks (<a href="databricks-sample-dashboard">example</a>). Additionally, you can launch ephemeral notebook runs or jobs. See the <a href="https://splunkbase.splunk.com/app/5416/#/details" target="_blank">app docs</a> for more detail.</li>
26+
<li>You can also configure the Splunk DB Connect app to run searches against Databricks via JDBC. The API used for this add-on is limited to 1000 results when running a simple query, but JDBC can pull back almost infinite amount of data. Additionally, as DB Connect supports multiple profiles, you can configure multiple connections with different levels of access. See our <a href="https://github.com/databrickslabs/splunk-integration/blob/master/docs/markdown/Splunk%20DB%20Connect%20guide%20for%20Databricks.md" target="_blank">integration docs</a> for configuration instructions.</li>
27+
<li>You can also send data from Databricks to Splunk via Splunk's HTTP Event Collector. This could be small sets of data, such as security alerts detected via AI on Databricks, or large sets of data such as aggregated or filtered high volume datasets. You can also use the Splunk REST API to run queries against data stored in Splunk from Databricks.</li>
28+
</ol>
29+
</html>
30+
</panel>
31+
</row>
32+
</dashboard>

‎app/default/data/ui/views/databricks-launch-notebook-two-params.xml

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
<form script="js/handle_autoforward.js">
2+
<label>Launch Notebook - Two Parameters</label>
3+
<search id="notebookrun">
4+
<query>| databricksrun notebook_path=$notebookname|s$ notebook_params="$param$=$paramvalue|dbquote$||$param2$=$param2value|dbquote$"</query>
5+
<earliest>-24h@h</earliest>
6+
<latest>now</latest>
7+
<sampleRatio>1</sampleRatio>
8+
<progress>
9+
<unset token="url"></unset>
10+
<unset token="failedJob"></unset>
11+
</progress>
12+
<done>
13+
<condition match="'job.resultCount' == 1">
14+
<set token="url">$result.result_url$</set>
15+
</condition>
16+
<condition match="'job.resultCount' == 0">
17+
<set token="failedJob">1</set>
18+
</condition>
19+
</done>
20+
<fail>
21+
<set token="failedJob">1</set>
22+
</fail>
23+
</search>
24+
<fieldset submitButton="false">
25+
<input type="text" token="notebookname">
26+
<label>Notebook Name</label>
27+
</input>
28+
<input type="dropdown" token="autoforward">
29+
<label>Auto Forward?</label>
30+
<choice value="No">No</choice>
31+
<choice value="Yes">Yes</choice>
32+
<default>No</default>
33+
</input>
34+
</fieldset>
35+
<row>
36+
<panel>
37+
<input type="text" token="param">
38+
<label>Parameter Name</label>
39+
</input>
40+
<input type="text" token="paramvalue">
41+
<label>Parameter Value</label>
42+
</input>
43+
</panel>
44+
</row>
45+
<row>
46+
<panel>
47+
<input type="text" token="param2">
48+
<label>Parameter 2 Name</label>
49+
</input>
50+
<input type="text" token="param2value">
51+
<label>Parameter 2 Value</label>
52+
</input>
53+
</panel>
54+
</row>
55+
<row depends="$failedJob$">
56+
<panel>
57+
<title>Job Failed</title>
58+
<single>
59+
<search base="notebookrun"></search>
60+
</single>
61+
</panel>
62+
<panel>
63+
<html>
64+
<p>
65+
The job failed -- this is usually because the cluster in Databricks is not working, credentials are expired, or other similar issues. Please see the red error icon to the left.
66+
</p>
67+
<button id="retryButton">Retry</button>
68+
</html>
69+
</panel>
70+
</row>
71+
<row depends="$notebookname$,$param$,$paramvalue$" rejects="$url$,$failedJob$">
72+
<panel>
73+
<title>Processing...</title>
74+
<html>
75+
<center>Processing</center>
76+
</html>
77+
</panel>
78+
</row>
79+
<row depends="$notebookname$,$param$,$paramvalue$,$url$" rejects="$failedJob$">
80+
<panel>
81+
<title>Click</title>
82+
<html>
83+
<center>Job running, <a href="$url$">click here</a> to proceed.</center>
84+
</html>
85+
</panel>
86+
</row>
87+
</form>

‎app/default/data/ui/views/databricks-launch-notebook.xml

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
<form script="js/handle_autoforward.js">
2+
<label>Launch Notebook</label>
3+
<search id="notebookrun">
4+
<query>| databricksrun notebook_path=$notebookname|s$ notebook_params="$param$=$paramvalue|dbquote$"</query>
5+
<earliest>-24h@h</earliest>
6+
<latest>now</latest>
7+
<sampleRatio>1</sampleRatio>
8+
<progress>
9+
<unset token="url"></unset>
10+
<unset token="failedJob"></unset>
11+
</progress>
12+
<done>
13+
<condition match="'job.resultCount' == 1">
14+
<set token="url">$result.result_url$</set>
15+
</condition>
16+
<condition match="'job.resultCount' == 0">
17+
<set token="failedJob">1</set>
18+
</condition>
19+
</done>
20+
<fail>
21+
<set token="failedJob">1</set>
22+
</fail>
23+
</search>
24+
<fieldset submitButton="false">
25+
<input type="text" token="notebookname">
26+
<label>Notebook Name</label>
27+
</input>
28+
<input type="text" token="param">
29+
<label>Parameter Name</label>
30+
</input>
31+
<input type="text" token="paramvalue">
32+
<label>Parameter Value</label>
33+
</input>
34+
<input type="dropdown" token="autoforward">
35+
<label>Auto Forward?</label>
36+
<choice value="No">No</choice>
37+
<choice value="Yes">Yes</choice>
38+
<default>No</default>
39+
</input>
40+
</fieldset>
41+
<row depends="$failedJob$">
42+
<panel>
43+
<title>Job Failed</title>
44+
<single>
45+
<search base="notebookrun"></search>
46+
</single>
47+
</panel>
48+
<panel>
49+
<html>
50+
<p>
51+
The job failed -- this is usually because the cluster in Databricks is not working, credentials are expired, or other similar issues. Please see the red error icon to the left.
52+
</p>
53+
<button id="retryButton">Retry</button>
54+
</html>
55+
</panel>
56+
</row>
57+
<row depends="$notebookname$,$param$,$paramvalue$" rejects="$url$,$failedJob$">
58+
<panel>
59+
<title>Processing...</title>
60+
<html>
61+
<center>Processing</center>
62+
</html>
63+
</panel>
64+
</row>
65+
<row depends="$notebookname$,$param$,$paramvalue$,$url$" rejects="$failedJob$">
66+
<panel>
67+
<title>Click</title>
68+
<html>
69+
<center>Job running, <a href="$url$">click here</a> to proceed.</center>
70+
</html>
71+
</panel>
72+
</row>
73+
</form>

‎app/default/data/ui/views/databricks-sample-dashboard.xml

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
<dashboard>
2+
<label>Sample Dashboard</label>
3+
<row>
4+
<panel>
5+
<title>Overview</title>
6+
<html>
7+
<p>This dashboard provides an example of using the "databricksquery" custom search command to query your databricks environment. As detailed in the <a href="https://splunkbase.splunk.com/app/5416/#/details" target="_blank">app docs</a>, the databricksquery command is limited to 1000 results. Full results can be pulled into Splunk via JDBC with <a href="https://splunkbase.splunk.com/app/2686/" target="_blank">Splunk DB Connect</a>, see our <a href="https://github.com/databrickslabs/splunk-integration/blob/master/docs/markdown/Splunk%20DB%20Connect%20guide%20for%20Databricks.md" target="_blank">configuration guide</a> for more detail. See <a href="intro">Intro</a> for an overview of the Databricks Add-on for Splunk.</p>
8+
</html>
9+
</panel>
10+
</row>
11+
<row>
12+
<panel>
13+
<table>
14+
<title>List of Tables (click to drill in)</title>
15+
<search>
16+
<query>| databricksquery query="show tables"</query>
17+
<earliest>-24h@h</earliest>
18+
<latest>now</latest>
19+
</search>
20+
<option name="drilldown">cell</option>
21+
<drilldown>
22+
<set token="table">$row.tableName$</set>
23+
</drilldown>
24+
</table>
25+
</panel>
26+
<panel depends="$table$">
27+
<table>
28+
<title>List of Fields in $table$ (click to drill in)</title>
29+
<search>
30+
<query>| databricksquery query="Describe $table$"</query>
31+
<earliest>-24h@h</earliest>
32+
<latest>now</latest>
33+
</search>
34+
<option name="drilldown">cell</option>
35+
<drilldown>
36+
<set token="field">$row.col_name$</set>
37+
</drilldown>
38+
</table>
39+
</panel>
40+
<panel depends="$field$">
41+
<table>
42+
<title>Top Values for $field$ in $table$</title>
43+
<search>
44+
<query>| databricksquery query="select $field$, count(1) from $table$ group by $field$ order by count(1) desc limit 30"</query>
45+
<earliest>-24h@h</earliest>
46+
<latest>now</latest>
47+
</search>
48+
</table>
49+
</panel>
50+
</row>
51+
<row depends="$table$">
52+
<panel>
53+
<table>
54+
<title>First Rows in $table$</title>
55+
<search>
56+
<query>| databricksquery query="select * from $table$ limit 50"</query>
57+
<earliest>-24h@h</earliest>
58+
<latest>now</latest>
59+
</search>
60+
</table>
61+
</panel>
62+
</row>
63+
</dashboard>

‎app/default/data/ui/views/launch_notebook_AR.xml

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
<form script="js/handle_autoforward.js">
2+
<label>Launch Notebook</label>
3+
<fieldset submitButton="false">
4+
<input type="text" token="orig_sid">
5+
<label>Adaptive Response Search ID (sid)</label>
6+
</input>
7+
<input type="text" token="orig_rid">
8+
<label>Adaptive Response Result ID (rid)</label>
9+
</input>
10+
<input type="dropdown" token="autoforward">
11+
<label>Auto Forward?</label>
12+
<choice value="No">No</choice>
13+
<choice value="Yes">Yes</choice>
14+
<default>No</default>
15+
</input>
16+
</fieldset>
17+
<search id="notebookrun">
18+
<query>index="cim_modactions" sourcetype="databricks:notebook" sid=$orig_sid$ rid=$orig_rid$ | table *</query>
19+
<earliest>-30d@h</earliest>
20+
<latest>now</latest>
21+
<sampleRatio>1</sampleRatio>
22+
<progress>
23+
<unset token="url"></unset>
24+
<unset token="failedJob"></unset>
25+
</progress>
26+
<done>
27+
<condition match="'job.resultCount' == 1">
28+
<set token="url">$result.result_url$</set>
29+
</condition>
30+
<condition match="'job.resultCount' == 0">
31+
<set token="failedJob">1</set>
32+
</condition>
33+
34+
</done>
35+
<fail>
36+
<set token="failedJob">1</set>
37+
</fail>
38+
</search>
39+
<row depends="$failedJob$">
40+
<panel>
41+
<title>Job Failed</title>
42+
<single>
43+
<search base="notebookrun">
44+
45+
</search>
46+
</single>
47+
</panel>
48+
<panel>
49+
<html><p>
50+
The job failed -- this is usually because the cluster in Databricks is not working, credentials are expired, or other similar issues. Please see the red error icon to the left.
51+
</p>
52+
<button id="retryButton">Retry</button></html>
53+
</panel>
54+
</row>
55+
<row depends="$orig_sid$,$orig_rid$" rejects="$url$,$failedJob$">
56+
<panel>
57+
<title>Processing...</title>
58+
<html>
59+
<center>Processing</center>
60+
</html>
61+
</panel>
62+
</row>
63+
<row depends="$url$" rejects="$failedJob$">
64+
<panel>
65+
<title>Click</title>
66+
<html>
67+
<center>Job running, <a href="$url$">click here</a> to proceed.</center>
68+
</html>
69+
</panel>
70+
</row>
71+
</form>

0 commit comments

Comments
 (0)