Splunk® Dashboards App

Splunk Dashboards app (beta) for Enterprise and Cloud

Download manual as PDF

Download topic as PDF

What is the new Splunk Dashboards app?

The Splunk Dashboards app provides two new workflows, the absolute and grid layouts, so you can build custom dashboards and visualizations in both single instances and distributed environments.

The following image is an example of a dashboard created using the Splunk Dashboards app. It utilizes custom icons, user inputs, the ability to layer objects, a custom background image, and other new features.

A dashboard in showing various SFO airport statistics.

New layout options

The Search & Reporting app uses a structure that snaps visualizations to a row-column structure. The new framework includes two different layout options, absolute and grid.

In the absolute layout option, you use your mouse or keyboard to drag and drop and resize objects on your dashboard. This layout also gives you pixel-perfect control and customizable backgrounds. When you use the absolute layout, the new visual editor allows you to add shapes, custom images, and icons to your dashboards and create searches in the form of data sources.

In the grid layout, you use a grid system to snap charts into rows. The grid layout allows you to create large dashboards quickly, but doesn't have most of the options available in the absolute layout. To see how the two compare, see Compare absolute and grid layouts.

New source code

Unlike the Search & Reporting app, which uses Simple XML as the source code, the source code for the new framework uses JSON-formatted components, or stanzas, in the dashboard and visualization workflow. Since each stanza is visually separate from the others, you can modify individual visualizations, searches, inputs, and global defaults, more easily compared to using Simple XML.

While you can import Simple XML dashboards to the app, some dashboard elements will not translate in the app and you'll receive an error message. For the best results, import dashboards with supported inputs, without tokens, and without code that is not Simple XML. For example, if you try to export dashboards that use JavaScript and CSS extensions, the dashboard might not render. To ensure your dashboard is fully operational, create it within the Dashboards app.

Additionally, you must use the source editor to set some options for visualizations, data sources and the layout. You must use the source editor to create all inputs and tokens.

Compare the classic Splunk Dashboards (Simple XML) and the Splunk Dashboards app (Beta)

The Splunk Dashboards app (Beta) is a new way for you to build Splunk Dashboards using a variety of tools for greater customization. While many features and visualizations are similar to the classic Splunk Dashboards (Simple XML), there are differences, both in what is available in the new app and the way visualizations look.

The following tables display which features are supported by what framework. This list will change with each new release of the Splunk Dashboards app (Beta).

Visualizations

Not all formatting options that are available in the classic Simple XML visualization reference are available in the Splunk Dashboards app. Some features, like thresholding and other trend coloring options, are configured differently in the Splunk Dashboards app than the way they are configured using Simple XML.

Some options in the Splunk Dashboards App (beta) visualizations can only be configured in source mode. The options available in the app for each visualization, and where you configure them, are listed in the visualization topics and in the Object options reference.

Some formatting options are only available in the app and not in the classic Splunk Dashboards framework. For example, you can use the new Action menu when you select objects in Edit mode to layer, copy, and delete those objects.

Use the following table to get an overview of supported features for both classic Splunk Dashboards (Simple XML) and the new Splunk Dashboards app:

Visualization Classic Splunk New Splunk Dashboards app Notes
Splunk-built custom visualizations Yes No If you are using the Splunk Dashboards app, certain custom visualizations are added as default visualizations in the Splunk Dashboards app.
3rd party visualizations Yes No N/A
Area and line charts Yes Yes N/A
Bar and column charts Yes Yes N/A
Pie chart Yes Yes If you are using the Splunk Dashboards app, you can use the option to turn a pie chart into a donut chart.
Filler and marker gauges Yes Yes N/A
Table Yes Yes; limited If you are using the Splunk Dashboards app, the table visualization does not display events or support trend coloring in the Splunk Dashboards app.
Singe value and single value radial Yes Yes N/A
Single value icon No Yes If you are using the Splunk Dashboards app, you can use this option to add a custom icon to a single value visualization.
Scatter chart Yes Yes N/A
Bubble chart Yes Yes N/A
Cluster maps Yes No N/A
Choropleth Maps (USA and World) Yes Yes If you are using the Splunk Dashboards app, the process of creating and formatting choropleth maps is different than in Simple XML. For more information, see Generate a choropleth map.
Choropleth SVG maps No Yes If you are using the Splunk Dashboards app, you can use custom SVG maps to create choropleth maps by connecting them to your Splunk data.
Trellis Yes No N/A
Shapes, lines, text boxes, icons, and images No Yes If you are using the Splunk Dashboards app, you can add and edit shapes and text boxes in the new app. You can use default Splunk icons, or use custom icons. You can use custom images for your dashboard backgrounds or as individual visualizations.

Data use

Some data source options can only be set in source mode. These options are listed under the data source topic they apply to.

Feature Classic Splunk New Splunk Dashboards app Notes
Data source types No Yes If you are using the Splunk Dashboards app, data sources are designated a type depending on the data they use. For using test data, you use ds.test. If you are using an SPL search, the data source type is, ds.search. To use a saved search, or report, use the ds.savedSearch data type. For chain searches, use ds.chain
Base and chain searches Yes Yes If you are using the Splunk Dashboards app, you can only configure chain searches in source mode. For more information see ds.chain.
Saved searches (reports) Yes Yes If you are using the Splunk Dashboards app, you can only reference saved searches in source mode. For more information, see ds.savedSearch.
Scheduled saved searches Yes Yes If you are using the Splunk Dashboards app, when using a scheduled saved search, the schedule of the search is always respected over all other settings.

Dashboard features

Dashboard-level features such as defaults and inputs, can affect entire dashboards.

Feature Classic Splunk New Splunk Dashboards app Notes
Inputs Yes Yes If you are using the Splunk Dashboards app, inputs must be configured in source mode. For more information, see Use inputs and tokens to make dashboards dynamic. Radio, checkbox, and link list inputs are not supported.
Dashboard defaults Yes Yes; limited If you are using the Splunk Dashboards app, setting defaults for a dashboard offers different levels of specification. For more information on using defaults in the app, see Use the defaults section to create global settings.
Drilldown Yes Yes; limited. If you are using the Splunk Dashboards app, you can only drilldown to internal directories or external URLs. You can't pass tokens through drilldown.
Tokens Yes Yes; limited If you are using the Splunk Dashboards app, tokens can only be generated using inputs. Tokens are not set when a dashboard loads. You cannot set tokens as a result of a search.
Tokens for visualizations Yes Yes, limited If you are using the Splunk Dashboards app, tokens can be used with inputs to affect visualizations. Inputs and tokens must be added and configured in source mode.
Tokens in base, chain, and saved searches Yes No N/A
Layouts Row-column layout Absolute and grid layouts If you are using the Splunk Dashboards app, the absolute layout is a free-form editing experience. The grid layout snaps your visualization panels to rows that change size with the largest visualization.
Content export - single visualizations No Yes If you are using the Splunk Dashboards app, you can select individual visualizations to download in PNG format. For more information, see Download a visualization.
Content export - dashboards Yes, limited Yes The classic Splunk Dashboard framework allows you to download dashboards in PDF format.

If you are using the Splunk Dashboards app, you can download a dashboard in a single PDF or PNG image. The result will look exactly the same as the dashboard appears in View mode. For more information, see Download a dashboard.

Custom Javascript (JS) Yes No N/A
Cascading Style Sheets (CSS) Yes No N/A

Giving feedback

Reach out to the engineering team with suggestions, requests for enhancement, and any bugs you might encounter. Your feedback is very valuable during this beta period. You can email the Splunk Dashboards app (beta) team at dashboards-beta@splunk.com.

Last modified on 11 August, 2020
  NEXT
Install the Splunk Dashboards app (Beta)

This documentation applies to the following versions of Splunk® Dashboards App: 0.6.0


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters