Docs » Getting Started » 15-Minute Quick Start

15-Minute Quick Start 🔗

Welcome to Splunk Infrastructure Monitoring!

  • If you are a trial user, thank you for signing up for a trial with Splunk Infrastructure Monitoring! This guide is written especially for you.
  • If you are not a trial user but are new to Infrastructure Monitoring, skip to Step 3. View infrastructure status to start learning about how your data is presented in Infrastructure Monitoring.

The first step to productivity with Infrastructure Monitoring is to install a cloud service integration, such as Amazon Web Services, and the Smart Agent, which monitors your infrastructure.

Step 1. Start monitoring a cloud service 🔗

  1. In a new window or tab, log into Infrastructure Monitoring and click Integrations on the navigation bar.

  2. On the Integrations page, click the tile for the cloud service you’d like to monitor.

  3. Click Create new integration and follow the installation instructions.

    When installation is complete, Infrastructure Monitoring begins listening for data from your account.

If you think you have correctly installed an integration, but data doesn’t arrive after several minutes, contact us at


While you start the installation process from a tile on the Integrations page, the installation instructions are also listed below for your reference.

Step 2. Start monitoring a host with the Smart Agent 🔗

The Smart Agent is a metric agent written in Go for monitoring infrastructure and application services in a variety of different environments. While you are waiting for data to start coming in from the cloud service (which can take a few minutes), install the Smart Agent.

  1. If you are not already logged into Infrastructure Monitoring, open a new window or tab, log into Infrastructure Monitoring, and click Integrations on the navigation bar.
  2. On the Integrations page, click the Smart Agent tile and follow the installation instructions to install the Smart Agent on a single host.

If you think you have correctly installed the Smart Agent, but data doesn’t arrive after several minutes, contact us at

Step 3. View infrastructure status 🔗

The Infrastructure Navigator provides a data-driven visualization of all the resources in your environment that are visible to Infrastructure Monitoring. Each is colored based on the value of one of several metrics. The metrics vary depending on what is being monitored (host, docker container, AWS instance, and so on).

To display the Infrastructure Navigator, click Infrastructure on the navigation bar.


The rest of this page reflects content that is visible if you install the Smart Agent. Similar content is shown if you installed a different integration, but instead you see resources specific to your system. For example, if you installed the Amazon Web Services integration, you will see content for AWS instances.

Multiple hosts view 🔗

The Infrastructure Navigator displays a square representing each host on which the agent has been installed. Each square is colored according to the value of the metric chosen in the Color By selector in the control bar (shown in the illustration below). The color of each host ranges from green (low) to red (high) depending on the value of the metric. When your cursor hovers above a box, you can see the host ID, name, and the value of the metric.


You will see one square for each host on which you have installed the agent. As a first-time user, you may see only one host (if you’ve only installed the agent on a single host). The illustrations below show what the Infrastructure page looks like with multiple hosts reporting.

Using the control bar 🔗

When you are looking at multiple hosts, you can “slice and dice” your view by using the Filter and Group By selectors in the control bar. This feature is generally more useful if you have installed the Smart Agent on multiple hosts, or when viewing data associated with a cloud service. For example, you might filter by a specific AWS availability zone to view only hosts in that zone. Alternately, you might group your hosts by availability zone to see the hosts in each zone. You can use either or both selectors to narrow down and customize your view.

Use the Color By selector to color the squares using the reported values of any of the following metrics:

  • CPU utilization (cpu.utilization)
  • Memory utilization (memory.utilization)
  • Disk utilization (disk.summary_utilization)
  • Total network traffic (
  • Total disk operations (
  • Most severe alert (red if there is a critical alert on the host, etc)

Using the information tabs 🔗

You can use the tabs below the navigator to display additional information.

  • The List tab displays several types of information about each host.
  • The Alerts tab displays the currently active alerts for the hosts.
  • The System Metrics tab contains a dashboard showing a curated set of infrastructure metrics gathered by the Smart Agent.

Single host view 🔗

To zoom in to view details about a single host, select one of the hosts by clicking on the appropriate square. When you have selected a single host, the Alerts tab will be filtered down to show information for the selected host, and the System Metrics tab will display a built-in dashboard showing information about just that host.

In addition, you will see tabs that provide more information about that single host:

  • Processes. A list of the active processes on the host, updated every 10 seconds, that can be sorted by various parameters.
  • Properties. The properties of the selected host that can be used for filtering and group‑by in the Multiple Hosts view.
  • If integrations for additional services have been deployed on the host, tabs for these services will appear here as well. Each tab displays a built-in dashboard for that service. Built-in dashboards are discussed in the next section.

To exit the single host view, click the X in the border around the selected host.

Step 4. View charts on a built-in dashboard 🔗

As discussed above, you can see the built-in dashboard for a service from the single host view in the Infrastructure Navigator. You can see the same dashboard, but with information on multiple hosts, on the Dashboards page.

To open the Dashboards page, hover over Dashboards on the navigation bar and select All dashboards.

Dashboards are groupings of charts and visualizations of metrics. Infrastructure Monitoring has three types of dashboards and dashboard groups: Built-in, Custom, and User. All dashboards, irrespective of type, belong to a dashboard group, and Built-In and Custom dashboard groups are displayed by default when you go to the Dashboards page.

To see the same dashboard you saw in the System Metrics tab for a single host in the Infrastructure Navigator, but with aggregated values for all hosts:

  1. Go to Built-in Dashboard Groups.
  2. Click Infrastructure to open the Infrastructure dashboard group.
  3. Click Infrastructure (a) to see the dashboard for all hosts. (The “a” stands for “aggregated.”)

Scroll through the dashboard to see a wide range of information relevant to your system.ß

What’s next? 🔗

Now that you have data coming into Infrastructure Monitoring, you might be ready to bring in data from additional resources or learn more about working with your data in the user interface.

Monitor more resources 🔗

The more data you send to Infrastructure Monitoring, the more visibility you have into your environment.

  • If appropriate, integration with additional cloud services.
  • As these instructions assume you have installed the Smart Agent, try installing the Smart Agent on more hosts. You can do this on an individual basis, or using a tool like chef or puppet. For more information, see Advanced Installation Options.
  • If you want the Smart Agent to discover additional metrics, configure the associated Smart Agent monitors. For information on configuring all our supported monitors, see Monitor Configuration.
  • Check out the many other ways to send data to Infrastructure Monitoring.

Learn more about using Infrastructure Monitoring 🔗

Getting around the UI 🔗

This Quick Start provides a brief overview of some of the features available in Infrastructure Monitoring. To familiarize yourself with additional features in Infrastructure Monitoring, check out Getting Around Splunk Infrastructure Monitoring.

Understanding basic concepts 🔗

To develop a baseline understanding of how metric data is represented in the user interface, so you can effectively find and filter information in the Infrastructure Navigator and in charts and dashboards, review the Infrastructure Monitoring data model and information about metadata.

Finding and viewing your metric data 🔗

You have data (metrics) coming in, but do you know what those metrics are? What are they named? How are they organized? It’s easy to browse through metrics coming into Infrastructure Monitoring; see Browsing for metrics.

Creating your first chart 🔗

Viewing data in built-in dashboards is great, but before long you will probably want to create charts of your own. Every user has a personal dashboard group that contains a blank dashboard. To open your personal dashboard, hover over Dashboards on the navigation bar and select All dashboards.

Your personal dashboard is shown at the top of the page. In this illustration, the personal dashboard name is the same as your email address. In some cases, your name may be displayed instead.

  1. Click on your personal dashboard to open it.
  2. Click Browse metrics sidebar in the New Chart placeholder.

The Metrics Sidebar opens.

  1. To search for metrics to place on a chart, type in whatever you know about the metric you’re looking for; for example, you might type cpu to see metrics related to CPU utilization. You can also browse by custom categories or integrations that have been installed, which lets you filter down your search results. (As a new user, you may not yet have any custom categories.)
  2. Click on any metric name in the search results to create a chart for that metric.

For a more detailed tutorial on creating a chart in a dashboard, see Create Simple Charts and Dashboards.

You can click on the chart name to open the chart and see it in the Chart Builder.

Creating a detector to trigger alerts 🔗

Receiving notifications when there is a problem is a key reason for monitoring your data. In Infrastructure Monitoring, detector rules trigger alerts, which send notifications to specified recipients.

The easiest way to create a detector is to base it on an existing chart. When you create a detector from a chart, the signal (or metric) that will trigger the alert is specified for you automatically. From there, you just need to set up a trigger condition and select notification recipients.

In this example, you’ll build a simple detector based on a static value.

  1. Find a chart that contains a metric you want to use as an alert signal. It could be the chart you just created or one of the built-in charts you saw earlier.

  2. Open the Detector menu for the chart (click the bell icon), select New detector from chart, then click Create alert rule.

    The Alert Rule Builder will be displayed automatically. On the Alert signal tab, you will see the metric or formula that will be monitored for alerts.

  3. On the Alert condition tab, select Static threshold.

  4. On the Alert settings tab, specify a threshold.


    You can specify a very low threshold to make sure some alerts will be triggered, just to see what they look like. Be sure to go back and change the threshold to something more useful later.

  5. You will use some default settings, so you can skip the Alert message tab.

  6. On the Alert recipients tab, click Add recipient and enter your email address.

  7. On the Activate tab, click Activate alert rule to save the detector.

    The detector will start monitoring data, and will send a notification when the alert is triggered and when it clears.

To see all active alerts, click Alerts on the global navigation bar.

To see a list of all detectors, hover over Alerts on the global navigation bar and select Detectors.

For more information about detectors, see Detectors and Alerts.