Splunk® Enterprise

Developing Dashboards, Views, and Apps for Splunk Web

Download manual as PDF

NOTE - Splunk version 4.x reached its End of Life on October 1, 2013. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Saved searches and dashboards

Before building a dashboard, you may want to create some saved searches. Familiarize yourself with Splunk's search language, create some searches that highlight the important aspects of your data, and then integrate them into dashboards. Dashboards allow you to then visualize data returned from searches in the form of charts, graphs and links. If you are creating Dashboards with Splunk's Dashboard Editor tools, you can run a search to see the results before you save it to the panel you are editing.

Resources for creating searches

If you've never worked with Splunk's search language before, read the User Manual section "Search and investigate." Create searches to highlight the most relevant aspects of your data and support your user's goals. The Search Reference Manual provides additional information on searching with Splunk, including a section on "Best practices", a "Search command cheat sheet", and a complete "Reference to Splunk search commands."

Saved searches and permissions

You can save searches a number of ways:

  • Splunk Web
  • Splunk Manager
  • Search Editor (for saving inline searches using Splunk's Dashboard Editor tools)
  • savedsearches.conf in your app or user directory

After saving a search, make sure permissions for the search allow access by users of the dashboard.

You can specify the following for a search:

  • Private Only you have access to the search
  • Available in an app The search is available only from the app in which it was created
  • Available in all apps' Essentially, the search is public.

You can also specify Read and Write permissions, based on user roles.

Save searches from Splunk Web

When saving the search from Splunk Web, specify permissions for the search. You can keep the search private or share the search with other users of the app.

Save search.png

Save searches from Splunk Manager

When creating searches with Splunk Manager, by default the search is private. After creating the search, in Splunk Manager, edit the permissions so users accessing your dashboard can run the search.

1. Select Manager > Searches and reports > New.

2. In the Add new screen, create your search and select Save.

3. In the list of searches, find your newly created search and select Permissions.

4. Specify the following:


  • Private
  • Available in the app in which it was created
  • Available in all apps

Also specify Read and Write permissions for user roles.


5. Click Save.

Save searches from the Search Editor

"Create and edit simple dashboards" in the Splunk User Manual describes how to add panels and searches to a dashboard. You can select either a saved search or an inline search for a panel in a dashboard.

If you select an inline search, edit permissions for the dashboard to set permissions for the search. See "Change dashboard permissions" in the User Manual for details.

Saved searches configuration file

When you save a search, Splunk writes information about the search to the savedsearches.conf file.

For private searches, Splunk places savedsearches.conf in your user directory:


For searches saved to an app, Splunk places savedsearches.conf in the following app directory:


Dashboards: An introduction
Step 1: Create a dashboard

This documentation applies to the following versions of Splunk: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7 View the Article History for its revisions.


How can I make the search public? The End users should be able to see the dashboard without logging into splunk. Please let me know if I need to change any settings to have this configured

June 11, 2012

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole
Feedback you enter here will be delivered to the documentation team

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters