Pre-built Splunk Dashboards for Kubernetes

Stop building Kubernetes dashboards. We did it for you.

Every alternative - Splunk Connect for Kubernetes, OpenTelemetry, Fluent Bit, vendor agents - ships data. Collectord ships a complete Splunk app: 50+ dashboards, an Alert Catalog of 118 alert templates, search macros, lookups, and field extractions for Kubernetes, with sibling apps for OpenShift and Docker. The dashboards lead you to what needs fixing: the Overview says whether anything is wrong and where, and a click takes you to the cause.

Install in ten minutes. Start investigating in the eleventh.

What’s in the app

The gallery follows the app’s own menu: the Overview, then Monitoring, Events, Cluster, Security, Audit and Setup.

Overview

The page the app opens on says whether anything is wrong, where, and who to tell. Its Workloads tab lists every workload by kind and its Pods tab the pods’ current state, each a click from the Workload and Pod pages.

⤢

Overview

One verdict for the fleet - Healthy, Warning, Critical, or Unknown - and the numbers behind it: clusters gone silent, nodes not ready, pods needing attention, crash loops, warning events and Collectord problems. Where on-call lands first.

Monitoring: nodes, pods, containers, processes

One view per layer of the stack, and the Top pages beside them to find the outliers. The Node, Container, Process and Workload pages complete the menu, each a click away with the filters already set.

⤢

Nodes

Every node with its capacity and usage, and their CPU, memory, pressure, I/O and network side by side, with the kubelet's log.

⤢

Pod

One pod: CPU, throttling, memory, pressure, I/O and network by container, with the pod's conditions, container statuses, events and logs - the single pane for any pod investigation.

⤢

Top: Nodes

Every node's CPU, I/O wait, steal and memory in one table. Pair with Node Capacity to find lopsided nodes.

⤢

Top: Pods

Every pod's CPU and memory in one table. Filter by namespace, node or pod label.

⤢

Top: Containers

Same shape as Top: Pods, scoped to containers - for multi-container pods and noisy sidecars.

⤢

Top: Processes

Every process across the nodes - CPU, threads, memory, swap, I/O and OOM score. Catches runaway sidecars and node-level offenders.

Events

Five views over the Kubernetes events. They count how many times a warning fired, not only how many event records there were, and a click on a crash loop, an OOM kill or a probe failure opens that pod’s logs. Logs, beside the menu, has the container logs with the same filters.

⤢

Event Overview

Warning records and occurrences side by side, critical conditions, failed scheduling, the top reasons and the namespaces with the most warnings.

⤢

Event Timeline

Every event matching the filters, by type, severity and class - resource, workload, scheduling, node or lifecycle.

⤢

Workload Failures

CrashLoopBackOff, OOMKilled, image pull, volume, sandbox and probe failures - a count and a table for each.

⤢

Scheduling and Node Health

FailedScheduling, NodeNotReady, evictions, and node pressure events (memory, disk, PID).

⤢

Recurring Problems

A seven-day window that surfaces patterns: the warnings that keep coming back, and the workloads and namespaces behind them.

Cluster: capacity, quotas, declarations

Everything about the cluster itself: how much of it is spoken for, what the namespaces use and declare, and the quotas that cap them. Resource Quotas completes the menu.

⤢

Cluster Capacity

How much of each cluster is spoken for, and how that has moved: pods, and CPU and memory requests, limits and usage, as a share of what the nodes make allocatable.

⤢

Namespace Usage

What each namespace uses against the requests and limits of its running pods - the tenant breakdown of a shared cluster.

⤢

CPU Throttling

The containers held back by their CPU limit, ranked by the share of CFS periods they were throttled in, beside how close to the limit they ran.

⤢

Workload Declarations

What the Pod specs declare rather than what the workloads use: request and limit coverage, probes, QoS classes, emptyDir and ephemeral storage, and GPUs - with the containers missing each.

Cluster › Nodes

What each node offers and holds.

⤢

Node Inventory

The nodes as the API server describes them: readiness and pressure conditions, cordoned nodes, kubelet, runtime and OS versions, taints, pod density, and how workloads spread across zones.

⤢

Node Capacity

What each node offers - allocatable CPU, memory and pod slots - against the requests, limits and pods scheduled on it. The capacity-planning anchor view.

⤢

Filesystem Usage

How full the filesystem behind each node's kubelet is, every other filesystem when Collectord measures them all, and the persistent volume claims.

⤢

Disk I/O

Requests and throughput per second, the wait per request and utilization of every block device.

⤢

GPU Utilization

GPU utilization, memory, power draw and temperature, and the processes using each GPU - for ML and AI workloads.

Cluster › System Components

The components that run the cluster, from the metrics Collectord scrapes on the nodes.

⤢

Kubernetes API

Requests, mean latency and errors, in-flight requests and queueing, client certificate expiry, and the objects held in etcd per resource.

⤢

etcd

Leader status, WAL fsync and backend commit latency against etcd's own guidance, failed proposals, gRPC health, and database size against its quota.

⤢

Kubelet

Per-node kubelet health - running against desired pods, pod start times, runtime and volume operations, and days left on its client certificate.

⤢

Scheduler

Scheduling latency and attempts by result, and the pods pending in each queue. Pair with Scheduling and Node Health under Events.

⤢

Controller Manager

Work queues - backlog, retries and the leader lease per controller - and zone health and evictions from the node lifecycle controller.

⤢

CoreDNS

The cluster DNS: requests, cache hits, response codes, latency and upstream health - the commonest cause of intermittent application failures.

⤢

Kube Proxy

How far behind kube-proxy's rule sync is, and the rules it programs on each node.

Security

What the pods are allowed to do, what they actually hold, and where the traffic goes. Access - SSH logins and sudo on the nodes, exec sessions and forbidden requests against the API server - completes the menu.

⤢

Pod Security Posture

Every container graded against the Kubernetes Pod Security Standards - privileged, host namespaces and paths, capabilities, root, seccomp and AppArmor, mutable image tags - and each pod's strictest profile.

⤢

Privileged Containers

What container processes actually hold at runtime: processes running as root and Linux capabilities - the container-escape surface.

⤢

Network (overview)

Where nodes and containers connect, with the remote endpoints outside the cluster on a map.

⤢

Network (connections)

Destinations outside the cluster, geolocated, and the traffic that crosses namespace boundaries.

⤢

Network (traffic)

What the nodes, namespaces and pods receive and transmit. Pair with connections for full network visibility.

Audit

Fourteen views over the API server audit log, in their own menu: an overview; detections for security threats, denied and failed requests, privileged operations, secrets and ConfigMaps, and RBAC changes; activity by identity, service account, namespace, mutation and object; and API server performance, deprecated APIs and the audit data’s own health.

⤢

Audit: Overview

Request volume, verbs, denials, exec sessions, impersonation and the busiest identities, with links into every other audit view.

⤢

Security Threats

Anonymous access, probing identities, impersonation and tampering, read from the API server audit log.

⤢

Deprecated APIs

Who still calls APIs a Kubernetes release removes, and the release that removes each one - your upgrade checklist.

Setup and self-monitoring

Configuration chooses the events-index or metrics-index dashboards and links the macros to tune. Collectord usage, Collectord metrics and the Splunk Usage Report watch Collectord itself and what its data costs on your Splunk license, and the Alert Catalog is where each team picks its alerts.

⤢

Splunk Usage Report

What Collectord's data costs on your Splunk license, from Splunk's own license meter - by source type, index, namespace, pod and container, with the heaviest log patterns.

⤢

Alert Catalog

118 alert templates to pick from, scope to your clusters and namespaces, and create as your own saved searches.

Beyond the dashboards

Your application metrics and any Kubernetes object, searchable next to everything above.

⤢

Prometheus Metrics

Per-pod metrics scraped via annotations - your application metrics in Splunk alongside infrastructure.

⤢

Kubernetes Objects

Stream any K8s API object type into Splunk - Secrets, ConfigMaps, Deployments - and search their state and changes alongside logs and events.

Dashboard ×

Plus an Alert Catalog of 118 alert templates

The app’s alerts come from the Alert Catalog (Setup › Alert Catalog): templates grouped by who acts on them - Splunk admins, the platform team, security, and application teams. Each team picks the ones it needs, scopes them to its own clusters and namespaces, tunes the thresholds, and creates them, with no SPL to write. Every template that reads stats works on the events index and on a Splunk metrics index. Monitoring OpenShift has 117 templates and Monitoring Docker 61.

A sampling of what’s included:

• Collectord and data delivery: Collectord stopped reporting, node without a collector, HEC requests failing, delivery lag, license expiring or overused
• Control plane: API server, controller manager, scheduler, kubelet, kube-proxy or etcd member not reporting, API server 5xx ratio and latency, etcd without a leader, slow WAL fsync, database approaching its quota, CoreDNS panics
• Nodes: node not ready or under pressure, CPU and memory above a threshold, memory and I/O stalls, clock not synchronized, conntrack table filling up, kernel OOM killer, a failed systemd unit, runtime disk and persistent volumes filling up
• Workloads: pod crash looping, container OOMKilled, image pull failing, pod pending, job failed, CronJob missed its schedule, CPU throttled, resource quota filling up
• Security: anonymous API request succeeded, exec into a pod, secret read by a person, RBAC role or binding written by a person, privileged or host-namespace pod created, image from an unapproved registry

→ Alerts for Kubernetes · for OpenShift · for Docker

How it gets there

Every dashboard is powered by data Collectord auto-collects from your cluster:

• Container logs, with no sidecars
• Container, node, process, and network metrics, to a Splunk events index or a metrics index
• Kubernetes events from the API server
• Pods, Nodes and ResourceQuotas watched by default; any other object kind (Secrets, ConfigMaps, Deployments) streamed as data on request
• Control-plane, CoreDNS and kube-proxy metrics, scraped by default
• Optional Kubernetes audit logs
• Optional Prometheus metrics from any pod (via annotations)
• Optional NVIDIA GPU metrics from an nvidia-smi DaemonSet you deploy on the GPU nodes

Install Collectord and the Splunk app once, and every dashboard above lights up with live data, except the ones built on optional inputs: the Audit menu needs the API server audit log enabled, GPU Utilization needs the nvidia-smi DaemonSet, and Prometheus Metrics needs annotated pods. No per-dashboard configuration, no per-cluster wiring.

→ Installation in 10 minutes · How Collectord compares to Splunk Connect for Kubernetes and OpenTelemetry Collector