Creating a Dashboard for Jamf Pro Data

You can add your search results in panel form to a new dashboard or an existing dashboard, and then customize the dashboard to meet your organization's needs.

  1. In Splunk, click the Search & Reporting app.
  2. In the Search tab, enter a search that will return results you want to display in a dashboard.
  3. Click Save As.
  4. Choose Dashboard Panel from the pop-up menu.
  5. Do one of the following:

    • Select New and configure settings for your dashboard.

    • Select Existing and select a dashboard.

  6. Click Save.
  7. Click View Dashboard to view your data in the dashboard.

Customizing the Dashboard for Jamf Pro

You can do the following to customize Splunk dashboards:

  • Switch between light and dark mode.

  • Edit the layout of panels.

  • Edit the visualization of individual panels.

The following screenshot shows how a customized Jamf Pro Dashboard might look:

For instructions on customizing the dashboard, see the Dashboards and Visualizations documentation from Splunk.

Jamf Pro Search and Visualization Examples

This section contains examples of search and visualization pairs that can be used as a starting point to display your data in a dashboard.

The following examples use searches based on data collected from the Jamf Pro Add-on for Splunk.

Total macOS Computers

SearchVisualization
source="jamf://JamfPro_Computers" computer.hardware.model=* | dedup computer.self.id| stats count by computer.hardware.model | sort count desc

Total macOS Computers by Hardware Model

SearchVisualization
source="jamf://JamfPro_Computers"| dedup computer.general.id | stats count

Total macOS Computers by Hardware Category

SearchVisualization
source="jamf://JamfPro_Computers" computer.hardware.model_identifier = * | dedup computer.self.id | eval model='computer.hardware.model_identifier' | rex field=model "(?<modelType>.*?)\d.*" | stats count by modelType | sort count desc

Remote Managed Computers

SearchVisualization
source="jamf://JamfPro_Computers" | dedup computer.general.id | replace "true" with "Yes", "false" with "No" in computer.general.remote_management.managed | chart count by computer.general.management_status.enrolled_via_dep

Enrollment Methods

SearchVisualization
source="jamf://JamfPro_Computers" | dedup computer.general.id | replace "true" with "Yes", "false" with "No" in computer.general.remote_management.managed | chart count by computer.general.management_status.enrolled_via_dep

Enrollment Date

SearchVisualization
source="jamf://JamfPro_Computers" | dedup computer.general.id | rex field= "(?<dateTtime>....-..-..T..:..:..).*?" | eval _time = strptime( 'computer.general.last_enrolled_date_utc', "%FT%T.%3N%z") | timechart span=1day count by true()

Days Since Last Check-in

SearchVisualization
source="jamf://JamfPro_Computers"| dedup computer.general.id | eval daysSinceLastContact=floor((now()-('computer.general.last_contact_time_epoch'/1000))/(60*60*24)) | stats count by daysSinceLastContact | sort daysSinceLastContact | makecontinuous daysSinceLastContact | rename count as "Devices", daysSinceLastContact as "Days Since Last Contact"