Documentation > Splunk > Developing Dashboards, Views, and Apps for Splunk Web > Dashboards: An introduction

Developing Dashboards, Views, and Apps for Splunk Web

 


Overview
Build dashboards
Build forms
Build advanced views
Customize Splunk Web
Build apps
Build scripted inputs
Extend Splunk
View reference material
Custom charting configuration reference

Dashboards: An introduction

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Contents

Dashboards: An introduction

A dashboard is a view containing one or more panels that display visualizations of data, such as tables, charts, and graphs. Dashboard panels typically retrieve data from an inline search or a saved search.

Dashboards live within apps, which means you can set permissions on a dashboard the same way you can with a saved search, event type, or other object. Once you build a dashboard you can navigate directly to it. For example, 

http://localhost:8000/en-US/<app>/<app_name>/<dashboard_name>

Why build a dashboard?

Dashboards are useful for customizing the display of data to a user. You can use dashboards to highlight interesting and useful aspects of your data, link to important searches, and display common reports.

For example, you can create a console for network operations console that provides an overview of the entire network, highlights which machines are down, and sends notifications of firewall violations.

How to build a dashboard

A dashboard contains panels organized by rows. Each row can contain one, two, or three panels. Each panel contains a search and a visual summary of that search.

Splunk provides tooling that lets you interactively create and edit basic dashboards without having to write a single line of XML code upon which the dashboard is based.

Use the Splunk Dashboard Editor to create a dashboard and layout its panels. Use the Search Editor to specify the search for each panel. Use the Visualization Editor to modify how to display the data in a panel. "Create and edit simple dashboards" and "Edit dashboard panel visualizations", both in the Splunk User manual, describe how to interactively create a dashboard.

Searches and dashboards

Panels within a dashboard are based on searches and reports. Much of the work in building a dashboard is designing searches and reports that highlight interesting data for your users.

You can specify a saved search or an inline search for a panel. If you specify a saved search, Splunk uses the most recent results from that search. If you set up a search to run on a schedule, the panel displays cached results form the search. Use saved searches if you have many long running searches or you expect many users to use the dashboard simultaneously.

Use an inline search to display results in real time. You specify an inline searches directly in the implementation of a panel.

To learn more about using saved searches in dashboards, read the next section: Saved searches and dashboards.

Create and edit dashboards using Simplified XML

Often you need to edit the underlying Simplified XML to go beyond the basic dashboards created with the editing tools. Splunk provides an XML editor to help you edit the underlying XML. You can also use any XML editor of your choice.

Here are a few reasons you may want to go beyond basic dashboard implementation to edit the underlying Simplified XML:

  • Specify color values for Single Values
  • Customize the appearance of charts, tables, lists, and other visualizations
  • Add radio buttons, drop-down menus, and other UI items

You can also create a dashboard from scratch, coding the implementation using Simplified XML.

Panels available for dashboards

With Simplified XML, you can specify the type of visualization to display in a panel. The visualizations available include the following:

  • Charts
  • Tables
  • Lists
  • Single button
  • Events
  • HTML

The panel reference lists all visualizations plus includes examples of the underlying Simplified XML.

Advanced XML

Most of the documentation in this manual describes creating and editing dashboards using Simplified XML. Simplified XML sits on top of Splunk's Advanced XML implementation. Complex dashboards and apps might need to leverage functionality only available from Advanced XML. For example, if you want to create a single search that is used by all panels in a dashboard, you have to implement the dashboard in Advanced XML.

You can always convert Simplified XML to Advanced XML. However, you cannot later go back to Simplified XML. Splunk recommends that you start advanced projects in Simplified XML, and then convert them later to Advanced XML to add the more complex features.

"Introduction to advanced views" in this manual provides details on editing Advanced XML.

For example, if you want to create a single search for a whole dashboard, you can implement postProcess search in Advanced XML, as described in How to use one search for a whole dashboard.

To convert Simplified XML to Advanced XML use the showsource URI: 

http://localhost:8000/en-US/app/<app_name>/<dashboard_name>?showsource=true
Retrieved from "http://docs.splunk.com/Documentation/Splunk/4.3.4/Developer/DashboardIntro"

This documentation applies to the following versions of Splunk: 4.3 , 4.3.1 , 4.3.2 , 4.3.3 , 4.3.4 , 4.3.5 , 4.3.6 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!