Developing Dashboards, Views, and Apps for Splunk Web

 


Saved searches and dashboards

NOTE - Splunk version 4.x reached its End of Life on October 1, 2013. Please see the migration information.

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Saved searches and dashboards

Before building a dashboard, you may want to create some saved searches. Familiarize yourself with Splunk's search language, create some searches that highlight the important aspects of your data, and then integrate them into dashboards. Dashboards allow you to then visualize data returned from searches in the form of charts, graphs and links. If you are creating Dashboards with Splunk's Dashboard Editor tools, you can run a search to see the results before you save it to the panel you are editing.

Resources for creating searches

If you've never worked with Splunk's search language before, read the User Manual section "Search and investigate." Create searches to highlight the most relevant aspects of your data and support your user's goals. The Search Reference Manual provides additional information on searching with Splunk, including a section on "Best practices", a "Search command cheat sheet", and a complete "Reference to Splunk search commands."

Saved searches and permissions

You can save searches a number of ways:

  • Splunk Web
  • Splunk Manager
  • Search Editor (for saving inline searches using Splunk's Dashboard Editor tools)
  • savedsearches.conf in your app or user directory

After saving a search, make sure permissions for the search allow access by users of the dashboard.

You can specify the following for a search:

  • Private Only you have access to the search
  • Available in an app The search is available only from the app in which it was created
  • Available in all apps' Essentially, the search is public.

You can also specify Read and Write permissions, based on user roles.

Save searches from Splunk Web

When saving the search from Splunk Web, specify permissions for the search. You can keep the search private or share the search with other users of the app.

Save search.png

Save searches from Splunk Manager

When creating searches with Splunk Manager, by default the search is private. After creating the search, in Splunk Manager, edit the permissions so users accessing your dashboard can run the search.

1. Select Manager > Searches and reports > New.

2. In the Add new screen, create your search and select Save.

3. In the list of searches, find your newly created search and select Permissions.

4. Specify the following:

Specify:

  • Private
  • Available in the app in which it was created
  • Available in all apps

Also specify Read and Write permissions for user roles.

EditPermissions.png

5. Click Save.


Save searches from the Search Editor

"Create and edit simple dashboards" in the Splunk User Manual describes how to add panels and searches to a dashboard. You can select either a saved search or an inline search for a panel in a dashboard.

If you select an inline search, edit permissions for the dashboard to set permissions for the search. See "Change dashboard permissions" in the User Manual for details.

Saved searches configuration file

When you save a search, Splunk writes information about the search to the savedsearches.conf file.

For private searches, Splunk places savedsearches.conf in your user directory:

$SPLUNK_HOME/etc/users/<user_name>/search/local/savedsearches.conf

For searches saved to an app, Splunk places savedsearches.conf in the following app directory:

$SPLUNK_HOME/etc/apps/<app_name>/local/savedsearches.conf)

This documentation applies to the following versions of Splunk: 4.3 , 4.3.1 , 4.3.2 , 4.3.3 , 4.3.4 , 4.3.5 , 4.3.6 , 4.3.7 View the Article History for its revisions.


Comments

How can I make the search public? The End users should be able to see the dashboard without logging into splunk. Please let me know if I need to change any settings to have this configured

Rahulsanjose
June 11, 2012

You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!