Create and edit simple dashboards

Create and edit simple dashboards

Beginning with Splunk 4.3, Splunk provides the Dashboard Editor to interactively build and edit simple dashboards without writing a single line of XML code. The Dashboard Editor is useful for creating and designing basic dashboards quickly. You can create multiple panels based on saved searches or inline searches. You can edit each panel in a dashboard using the Search Editor and the Visualization Editor.

The Search Editor allows you to modify the search and includes an option to test the search before saving your changes. The Visualization Editor allows you to specify how to display the returned data by specifying features such as drilldown behavior, visualizations, data overlays, line wrapping, and column numbers. Visualizations include specifying tables or lists of events, or when appropriate, charts and graphs available for the data returned. Data overlays include heat maps or high and low values. You can rearrange panels easily with the drag-and-drop interface of the Dashboard Editor.

If you want to create complex dashboards with features such as form inputs and special drilldown actions, edit the XML implementing the dashboard. Refer to "Forms: An Introduction" and "Introduction to advanced views" in the Developer Manual for more information on creating and editing complex dashboards.

Note: A common workflow for creating complex dashboards is to first use the Dashboard Editor to create and lay out the panels. Use the Search Editor and Visualization Editor to fine tune the search and change or modify the visualization of returned data. Then edit the XML as needed to implement any additional functionality. Advanced features of the dashboard may require using Advanced XML, as described in "Introduction to advanced views" in the Developer Manual.

The following sections provide examples of how to use the Dashboard Editor, Search Editor, and Visualization Editor to create and edit a simple dashboard.

Create a dashboard with two panels

This example shows you the basics of the Dashboard Editor. It shows how to create a dashboard with two panels, one panel based on a saved search and the other based on an inline search that you specify. It also shows how to rearrange the panels in the dashboard using drag and drop.

The searches used in this example are based on the Flower Shop Tutorial described earlier in this manaul. However, you can substitute the searches in this example with any similar type of search.

1. Select Dashboards & Views > Create Dashboard. After providing an ID and a name for the dashboard, the Dashboard Editor opens.

• Specify TestDashboard and "Test Dashboard" for the ID and the name, then click Create..
• The initial dashboard is empty and the editing feature is Off.

2. Click Edit: On.

Next, click New Panel.

• Specify "Errors in the last 24 hours" for the Title
• Select the saved search, "Errors in the last 24 hours"
• Click Save, to add the panel to the dashboard

3. Click New Panel to add an additional panel to the dashboard:

• Specify "Flower Store Price Difference (Last 7 days)" for the Title
• Select inline search and specify the following for the search:

sourcetype=access_* | stats values(product_name) as product by price, flowersrus_price | eval difference = price - flowersrus_price | table product, difference

• Specify a time range of -7d to now.

Note: For information about defining search time ranges with relative time syntax (a set start and end time) see "Change the time range to narrow your search" in this manual. For information about setting up real-time searches and real-time search windows, see "Search and report in real time" in this manual.

• Click Save.

4. Click and drag the newly added panel, placing it to the right of the initial panel.

5. Click Edit: Off to turn off the editing feature.

The dashboard is now available for use. You can access the dashboard from the Dashboard & Views menu.

Note: When in editing mode, the Dashboard Editor resizes a panel so it is smaller than the actual size, showing only the top portion of the panel. When you turn off editing mode, the entire panel is visible.

Modify the search in a panel

Use the Search Editor to modify the search for a panel. The Search Editor also provides an option to test the search before you save it. The editing options available to you differ for inline searches and saved searches.

Inline searches

For inline searches, the Search Editor provides the following options:

• Replace the inline search with a saved search (If you select this option, the Search Editor displays the options for saved searches, listed below.)
• Modify the search string
• Modify the time range
• Run the search to preview the results

Saved searches

For saved searches, the Search Editor provides the following options:

• Select a different saved search
• Edit the search in Splunk Manager
• Replace the saved search with an inline search (If you select this option, the Search Editor displays the options for inline searches.)
• Run the search to preview the results

Note: If you want to edit a saved search query, either change the search to an inline search or edit the search query in Splunk Manager. You cannot edit a saved search query directly in the Search Editor.

Search Editor example

1. If editing mode for the test dashboard is not enabled, click Edit: On.

2. In the Flower Store Price Difference panel, select Edit > Edit Search.

3. Edit the search string and specify a time range of -1mon to now.

4. Click Run search to test the new search, which opens in a new tab or window of your browser.

5. Close the test run, click Save.

6. in the Errors in the Last 24 Hours panel, select Edit > Edit Search.

7. Click Edit in manager. The saved search opens in the Splunk Manager. Modify the search and click Save.

Change the visualization of panels in a dashboard

After you create a panel with the Dashboard Editor, use the Visualization Editor to change the visualization and other features of the panel.

Depending on the type of search specified in the panel, you can display the results in a table, a list of events, or in any of various charts. Only searches containing a transform operation can be displayed as a chart. A transform operation uses reporting commands such as stats, chart, timechart, top, or rare. Refer to "Use reporting commands" for more information.

You can also do the following in the Visualization Editor:

• Edit the Panel Title
• Specify drilldown options by row or cell, or disable drilldown entirely
• Specify whether to display row numbers for tabular data
• Specify a data overlay for a Heat Map or High and Low Values

Note: For information on the types of visualizations available, refer to the Visualization Reference in this manual. For information on Splunk drilldown features, refer to "Understand basic table and chart drilldown actions."

The following example shows how to modify the two panels in the Test Dashboard created in the previous example. "Edit dashboard panel visualizations" in this manual provides additional information and examples on creating and editing visualizations.

1. If editing mode for the test dashboard is not enabled, click Edit: On.

2. In the Errors in Last 24 Hours Panel, click Edit > Edit Visualization.

3. Make the following edits in the Visualization Editor:

• For Visualizations, select Events.
• For Row numbers, select No.
• For Wrap results, select Yes.

4. Click Save, then click Edit: Off.

The panel now displays errors as a wrapping list

5. In the dashboard, click Edit: On.

6. In the Flower Store Price Difference panel, select Edit > Visualization.

7. Make the following edits in the Visualization Editor:

• For Drilldown, select Cell.
• For Row numbers, select No.
• For Data overlay, select Heat Map.

8. Click Save, then click Edit: Off.

Notice your visualization changes, including that drilldown is enabled for the Product cells.

Edit the XML configuration of a dashboard

You can also edit a dashboard and the panels it contains by editing the XML configuration for the dashboard. This provides editing access to features not available from the Dashboard Editor. For example, edit the XML configuration to change the name of dashboard or specify a custom number of rows in a table.

1. If editing mode for the Test Dashboard is not enabled, click Edit: On.

2. Click Edit XML to open the Splunk XML Editor for the Test Dashboard.

Change the name of the dashboard to "My Dashboard" and specify 5 rows for the Flower Store Price Table, as indicated in the code sample:

<?xml version='1.0' encoding='utf-8'?>
<dashboard>
  <label>My Dashboard</label>
  <row>
    <event>
      <searchName>Errors in the last 24 hours</searchName>
      . . .
    </event>
    <table>
     . . .
      <title>Flower Store Price Difference (Last 7 days)</title>
      <earliestTime>-7d</earliestTime>
      <latestTime>now</latestTime>
      <option name="count">5</option>
      . . .
    </table>
  </row>
</dashboard>

For more information about editing XML for dashboards created with the Dashboard Editor, see "Dashboards: An Introduction" in the Developer manual.

Change dashboard permissions

You can specify access to a dashboard from the Dashboard Editor. However, your user role (and capabilities defined for that role) may limit the type of access you can define.

For example, if your Splunk user role is user (with the default set of capabilities), then you can only create dashboards that are private to you. You can, however, provide read and/or write access to other users.

If your Splunk user role is admin (with the default set of capabilities), then you can create dashboards that are private, visibile in a specific app, or visible in all apps. You can also provide access to other Splunk user roles, such as user, admin, and other roles with specific capabilities.

For additional information on user roles, capabilites, and permissions refer to "Share and promote knowledge objects" in the Admin manual.

Edit permissions for an admin user

The following example shows how an admin user can specify permissions for a dashboard.

Note: For other user roles, such as user, the choices for permissions in the Dashboard Editor are a subset of the choices available to the admin user.

1. If editing mode for the test dashboard is not enabled, click Edit: On.

2. In the Dashboard Editor, select Edit permissions

3. Specify the views in which the dashboard is visible. choose from the following:

• Keep private: The dashboard is only visible to the user who created it. In this example, the admin user.
• This app only (app name): Dashboards can be visible to a specific app. app name refers to the app that you were in when you created the dashboard. From the Manager pages, you can change the app specific to a dashboard.
• All apps: The dashboard is visible from all apps.

4. Specify the user roles that have access, and their type of access.

• You can specify that the dashboard is visible to all users, or you can select a combination of different user roles.
• Specify the Read and Write permissions for each role you select.

5. Select Save and click Edit: off.

Manage dashboard navigation

Because dashboards are a type of view, by default any new dashboard appears in the View drop-down list in the Splunk Web navigation menu. Edit the XML behind the navigation menu to:

• Change the the location of unclassified dashboards. You can move dashboards to existing lists (or "view collections") in the navigation menu, or create new lists for them.
• Create nested collections (view collections within navigation bar lists) that classify similar dashboards together. For example, under your Dashboards dropdown, you could have a "Web Server" collection that groups together a set of dashboards that display different kinds of firewall information for your web server.

Note: Navigation is managed on an app by app basis. If your dashboard has been promoted globally to all of the apps in your system, it initially appears in the default drop-down list for "unclassified" views in those apps' top-level navigation menus. Users with write permissions for those apps can move the dashboard to its proper location in the app navigation menus as appropriate.

For an overview of navigation menu management see "Define navigation for saved searches and reports" in the Knowledge Manager manual.

If you have write permissions for your app, you can access its navigation menu XML by opening Manager, clicking Navigation Menus, and then clicking the name of the navigation menu for your app. See the "Build navigation for your app" topic in the Developer manual for details about working with the navigation menu code.

Delete panels and dashboards

You can delete panels from a dashboard using the Dashboard Editor or editing the XML configuration. You delete a dashboard from Splunk Manager. You must be logged in as an admin and have permission to delete the dashboard.

Delete a panel from a dashboard

1. If editing mode for the dashboard is not enabled, click Edit: On.

2. For the panel, select Edit > Delete.

OR

2. Click Edit XML and delete the XML code implementing the panel.

Delete a dashboard

1. Login as an admin user and go to Manager > User interface > Views.

2. Locate the dashboard in the list of views. Locate the Delete link under Actions (visible if you have permissions to delete the dashboard). Click Delete.

• Was this topic useful?
• Post a comment