Splunk® Enterprise

Dashboards and Visualizations

Download manual as PDF

Download topic as PDF

Working with dashboard panels

A dashboard contains one or more panels. Dashboard panels use searches to generate visualizations. Select a panel type depending on the type of search behavior and configuration options that you want.

Inline panel

An inline panel contains a search directly in its source code. The search generates the results rendered in the panel visualization. You can edit an inline search using the dashboard editor.

Panel from a report

This panel type uses the saved search and visualization from a report.

When using a panel from a report, you cannot modify the search string in the panel, but you can change and configure the visualization. If the report search changes, the panel using that report updates accordingly.

Access and performance considerations

Depending on your deployment, you might need to adjust report configurations for dashboard performance and access. For instance, depending on your permissions, you can control whether the report is accelerated, scheduled, or embedded. You can also change the report permissions.

User context

Reports in dashboard panels can run as the report owner or the report user. These settings can affect data visibility and concurrent search limits.

Option Description Data visibility impact Concurrent search limit impact
Run as owner (default) Run the report using the permissions of the user who created the report.

Scheduled reports always run using report owner permissions.
A report run with owner permissions renders search results that some users might not otherwise have permission to see. In some cases, you might want to provide this kind of access. In other cases, you might want to restrict search result visibility. If a dashboard containing a report-backed panel loads multiple times simultaneously, it can impact the report owner's concurrent search limit. When the limit is reached, the report scheduler causes additional report search runs to be queued for later execution.

Dashboard users might see slower panel loading and the report owner might not be able to run searches and reports immediately.
Run as user Run the report with the permissions of the user viewing the dashboard.

Scheduled reports cannot run with user permissions.
If the report accesses data that the current user does not have permission to see, the panel does not render those results. When the report runs, it counts against the concurrent search limit of the user loading the dashboard, not the report owner.


Use scheduled reports for dashboard panels when possible

Back dashboard panels with scheduled reports whenever possible to reduce search processing load for your Splunk deployment.

Benefits of scheduled reports
Not using scheduled reports can impact search processing loads and concurrent search limits. For example, If fifty users access a particular dashboard, panels not backed by scheduled reports cause their reports to rerun fifty times.

Scheduled reports do not require the search to run each time a user loads the dashboard. Panels backed by scheduled reports show results from the last scheduled run of the report.

Using real-time scheduled reports
To show dashboard users the most current results, back dashboard panels with real-time scheduled reports. This report type runs in the background at all times. It does not launch a new report instance each time a user loads the dashboard. Instead, it shows results for the currently running real-time scheduled report.

Prebuilt panel

Save and reuse Simple XML panels in multiple dashboards. You can display a prebuilt panel in a dashboard by using a reference to the panel. Edit the panel directly to change the title, search, or visualizations in it.

Additional information

PREVIOUS
Create a dashboard
  NEXT
Add panels to dashboards

This documentation applies to the following versions of Splunk® Enterprise: 6.5.1612 (Splunk Cloud only), 6.6.0, 6.6.1, 6.6.2


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters