Merge pull request #1355 from splunk/repo-sync

Pulling refs/heads/main into main

gdi/get-data-in/connect/aws/aws-prereqs.rst

@@ -79,6 +79,8 @@ When you're creating the new permission for your user and are prompted for an ac
 Required permissions
 =====================================================
 
+.. caution:: The list of permissions described in this section is updated frequently. If you connected your AWS services to Splunk Observability Cloud a while ago you might need to update them.
+
 These are the required permissions to collect AWS data:
 
 * :ref:`Required permissions <aws-iam-policy-required>`

index.rst

@@ -669,6 +669,11 @@ View a list of all supported integrations :ref:`supported-data-sources`
 
    Use navigators <infrastructure/use-navigators>
 
+.. toctree::
+   :maxdepth:   3
+
+   Filter data <infrastructure/filter-landing-page>
+
 .. toctree::
    :maxdepth:   3
 

infrastructure/filter-landing-page.rst

@@ -0,0 +1,64 @@
+.. _filter-landing-page:
+
+****************************************************************
+Filter data on your landing page
+****************************************************************
+
+.. meta::
+    :description: Filter the data displayed by navigators on your Splunk Infrastructure Monitoring landing page
+
+To narrow the scope of the data you want to analyze, try filtering on data sources on the Splunk Infrastructure Monitoring landing page.
+On the Infrastructure Monitoring landing page, each card represents a navigator corresponding to the services you monitor in Splunk Observability Cloud. A navigator card shows a count of instances in the population and highlights critical alerts linked to that population.
+
+.. _build-filter:
+
+Create a filter
+----------------------
+
+To create a filter, you search in the filter database using any of the following parameters:
+* Filter name
+* Property name
+* Special characters
+
+.. _apply-filter:
+
+Apply a filter
+----------------------
+
+To filter data on the landing page, perform the following steps: 
+
+#. Select :guilabel:`Add filters`
+#. Find the filter you want in either of the following ways:
+   - Scroll through the dropdown list of filters displayed in alphabetical order.
+   - Use the text field displayed above :guilabel:`Add filters` to enter search parameters.
+#. Select the name of the filter you want.
+#. Hover over the filter name to see and select one or more of the recommended values for that filter.
+#. Select :guilabel:`Apply filter`
+#. (Optional) Repeat steps 2 through 5 for any other filters you want to apply.
+
+Filters that you apply on the Infrastructure Monitoring landing page persist in the navigators accessed through data source cards on that page, so that you see only relevant instances.
+
+Source cards on the landing page default briefly to a grayed-out loading state while your filter or filters are applied. If no data matches the parameters of a filter that you have applied, the system returns a “No Matching Result” message.
+
+ .. note:: Applying any filter narrows the range of filters available to you in that session, because Splunk Infrastructure Monitoring uses your input to determine what subset of filters applies to the data you want. You can't, for example, mix AWS (Amazon Web Services) filters with GCP (Google Cloud Platform) filters.
+
+Splunk Infrastructure Monitoring adds filters to the URL for the data source to which they apply. You can bookmark filtered views for later reference or to share with other people on your team.
+
+If you remove a filter, any data source cards that had been hidden because they were filtered out reappear on your landing page. Data source cards can also display unexpectedly if an entity that was dormant because no data was found for it changes state to become active.
+
+Remove a filter
+----------------------
+
+You remove a filter in either of the following ways:
+
+- On the Splunk Infrastructure Monitoring landing page, select X on the filter label you want to close. 
+
+- From within a navigator, select :guilabel:`All infrastructure`. This returns you to the Infrastructure landing page in its default state, without filters. 
+
+ .. note:: To return to the Infrastructure landing page from within a navigator without losing filters you've already set up, use the back button on your web browser.
+
+
+
+
+
+

infrastructure/use-navigators.rst

@@ -277,24 +277,41 @@ If a service has any active alerts, you can view a list of the service's alerts
 #. Search for the navigator that you want to view. 
 #. Under the navigator title, select the text displaying the number of alerts. Alert numbers and types vary depending on the navigator. 
 
-For the following example navigator, the user selects :guilabel:`90 Critical alerts`. 
+For the following example navigator, the user selected :guilabel:`90 Critical alerts`. 
 
 .. image:: /_images/infrastructure/navigator-alerts.png
         :width: 50%
         :alt: This image shows a navigator with 90 critical alerts active
 
 Selecting this text opens a detailed view of the navigator with a list of active alerts shown on the sidebar.
 
+.. _view-navigators-from-alerts:
+
+View navigators using alerts
+---------------------------------------------
+
+When you're investigating an alert, you can refer at a glance to :guilabel:`Infrastructure` in the :guilabel:`Next Steps` section of the modal window displaying that alert. The section displays a link to the relevant Infrastructure Monitoring navigator. Select that link to open the navigator without losing contextual metadata from the alert. Applicable metadata passes automatically from the alert to the navigator. 
+
+.. image:: /_images/infrastructure/alert-to-nav.png
+        :width: 50%
+        :alt: An alert with a clickable link to an EC2 navigator
+
+Variable data passed from alerts to navigators includes the time that the alert occurred as well as relevant metrics and properties from the alert.
+
+By linking alerts in real time with the navigators that triggered them, the  "alert to navigator" experience makes troubleshooting faster.
+
+
+
 .. _remove-navigator:
 
 Remove an inactive navigator
 -------------------------------
 
 .. note:: You need to be an admin to remove a navigator.
 
-When data for an integration hasn't been received for 72 hours, the navigator for that integration becomes inactive and you have the option remove it from view. The navigator automatically reappears if data for the integration comes in again.
+When data for an integration hasn't been received for 72 hours, the navigator for that integration becomes inactive, and you have the option remove it from view. The navigator automatically reappears if data for the integration is received again.
 
-Follow these steps to remove an inactive navigator.
+Follow these steps to remove an inactive navigator:
 
 #. Select :guilabel:`Infrastructure` from the Splunk Observability Cloud home page. You can only remove a navigator when you're in the Infrastructure Monitoring landing page view.
 #. On an inactive navigator, select :guilabel:`Remove Navigator`.