Working with dashboard panels

A dashboard contains one or more panels. Dashboard panels use searches to generate visualizations. Select a panel type depending on the type of search behavior and configuration options that you want.

Inline panel

An inline panel contains a search directly in its source code. The search generates the results rendered in the panel visualization. You can edit an inline search using the dashboard editor.

Panel from a report

This panel type uses the saved search and visualization from a report.

When using a panel from a report, you cannot modify the search string in the panel, but you can change and configure the visualization. If the report search changes, the panel using that report updates accordingly.

Access and performance considerations

Depending on your deployment, you might need to adjust report configurations for dashboard performance and access. For instance, depending on your permissions, you can control whether the report is accelerated, scheduled, or embedded. You can also change the report permissions.

User context

Reports in dashboard panels can run as the report owner or the report user. These settings can affect data visibility and concurrent search limits.

Option	Description	Data visibility impact	Concurrent search limit impact
Run as owner (default)	Run the report using the permissions of the user who created the report. Scheduled reports always run using report owner permissions.	A report run with owner permissions renders search results that some users might not otherwise have permission to see. In some cases, you might want to provide this kind of access. In other cases, you might want to restrict search result visibility.	If a dashboard containing a report-backed panel loads multiple times simultaneously, it can impact the report owner's concurrent search limit. When the limit is reached, the report scheduler causes additional report search runs to be queued for later execution. Dashboard users might see slower panel loading and the report owner might not be able to run searches and reports immediately.
Run as user	Run the report with the permissions of the user viewing the dashboard. Scheduled reports cannot run with user permissions.	If the report accesses data that the current user does not have permission to see, the panel does not render those results.	When the report runs, it counts against the concurrent search limit of the user loading the dashboard, not the report owner.

Use scheduled reports for dashboard panels when possible

Back dashboard panels with scheduled reports whenever possible to reduce search processing load for your Splunk deployment.

Benefits of scheduled reports
Not using scheduled reports can impact search processing loads and concurrent search limits. For example, If fifty users access a particular dashboard, panels not backed by scheduled reports cause their reports to rerun fifty times.

Scheduled reports do not require the search to run each time a user loads the dashboard. Panels backed by scheduled reports show results from the last scheduled run of the report.

Using real-time scheduled reports
To show dashboard users the most current results, back dashboard panels with real-time scheduled reports. This report type runs in the background at all times. It does not launch a new report instance each time a user loads the dashboard. Instead, it shows results for the currently running real-time scheduled report.

Prebuilt panel

Save and reuse Simple XML panels in multiple dashboards. You can display a prebuilt panel in a dashboard by using a reference to the panel. Edit the panel directly to change the title, search, or visualizations in it.

Additional information

• To learn about using the dashboard editor to add or edit dashboard panels, see Add panels to dashboards.
• For more details on panel searches, see Searches power dashboards and forms.
• See Edit dashboards and Edit visualizations to learn more about editing panel visualizations.
• To learn about working with reports, see Create and edit reports and Schedule reports in the Reporting Manual.