Splunk® Enterprise

User Manual

Download manual as PDF

Splunk version 4.x reached its End of Life on October 1, 2013. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Build and share a dashboard

Before you proceed with this topic you should review Reporting on field values, where you have already built and saved a few reports. This topic walks you through creating simple dashboards that use the same searches and reports that you saved in the previous topics.

Back at the Flower & Gift Shop, your boss asks you to put together a dashboard to show metrics about the products sold at the online shop. You also decide to build yourself a dashboard to help you or another member of the IT team find and troubleshoot problems with the online shop.

Flower & Gift Shop Products

The first dashboard will show metrics related to the day-to-day purchase of different products at the Flower & Gift shop. For this dashboard, you'll use the saved searches:

  • Products Purchased (Yesterday)
  • Products & Revenue (Yesterday)
  • Purchases & Views (Yesterday)

To start, make sure you're in the Search app.

1. Click Dashboards & Views and select Create dashboard... from the list.

Create dashboard prod 4.3.png

This opens the Create new dashboard dialogue which enables you to define a new dashboard.

2. To create the new dashboard:

Create dashboard prods 4.3.png

2a. Designate the unique ID for this dashboard as "Products". This ID is the name you use to refer to the dashboard from other objects within Splunk.

2b. Name the dashboard, Flower & Gift Shop - Products. This name is the label that you will see listed in the navigation menus and at the top of your dashboard.

2c. Click Create.

This takes you to your new dashboard, which is currently empty. Let's start filling it with panels.

3. At the top of the dashboard, next to its name, are dashboard options. When Edit is turned off, you will see options for printing the dashboard and PDF delivery.

Dashboard editor prod 4.3.png

Let's not worry about these options right now. You can read more about them later

3a. To start editing the dashboard, toggle the Edit switch to ON.

Panel editor prod 4.3.png

When Edit is turned ON, you will see three options:

  • New panel enables you to add panels to the dashboard.
  • Edit XML enables you to edit the XML code for the dashboard.
  • Edit permissions enables you to control who has access to the dashboard.

3b. To add a panel to the dashboard, click New panel.

This opens the New panel dialogue which enables you to define properties for the panel.

4. To add a new panel to the dashboard, give it a name and specify the search to associate with it:

New panel dialogue 4.3.png

4a. Under Title, name the panel "Products Purchased (Yesterday)". This is the label for the panel.

4b. Under Search command, select "Saved search".

All dashboard panels are associated with searches. You can specify whether a panel runs off of a predefined, saved search, or whether it uses a search that has been specifically designed for the panel and associated with it in an "inline" manner. For these dashboards, you'll just use saved searches and reports.

4c. From the list, select the saved search named "Products Purchased (Yesterday)".

4d. Click Save.

Now you've added a new panel to the "Flower & Gifts Shop - Products" dashboard. Here, by default, the search results are displayed as a table. This is not the visualization you want for this panel, though, so let's change it.

Edit panel vis 4.3.png

5. For the panel, click Edit and select Edit visualization... from the list.

This opens the Edit visualization dialogue which enables you to modify how the search results are represented in the panel: data table, events list, charts, single value panels, and gauges. For more information about visualization options, read... Link me!

Edit vis dialogue1 4.3.png

6. From the list of "Visualizations", select Column to display your results in a stacked column chart.

Edit vis dialogue2 4.3.png

7. Click Save.

Now, the panel should look like this:

Prod panel1 chart 4.3.png

8. Add two more new panels to the dashboard:

8a. Add panel named Purchases & Views (Yesterday) for the count of purchases and views made yesterday (# Purchases & Views). Edit the visualization type to display a column chart.

8b. Add panel named Products & Revenue (Yesterday) to list the products that were sold yesterday and the revenue made from the sales (Purchases and Revenue (Yesterday). Edit the visualization type to display a data table.

8c. Once you've added the new panels, drag the panels to rearrange them so that they display like this:

Prod dashboard 4.3.png

This is your products dashboard. Now let's follow the same steps to create an operations dashboard.

Flower & Gift Shop Operations

The second dashboard includes simple reports that you can view at the start of your day to give you some information about recent web access activity. For this dashboard, you'll use the saved searches:

  • Total views (Yesterday)
  • Failed purchases (Yesterday)
  • Errors (Yesterday)

To start, return to the Search app.

1. Click Dashboards & Views and select Create dashboard... from the list and define a new dashboard for Flower & Gift Shop - Operations.

Create dashboard ops 4.3.png

2. For this dashboard, you will add three panels: two single value panels and an events list panel. It will look like this:

Ops dashboard 4.3.png

2a. The first panel uses the saved search "Total views (Yesterday)" and is a single value panel.

2b. The second panel uses the saved search "Failed purchases (Yesterday)" and is a single value panel.

2c. The third panel uses the saved search "Errors (Yesterday)" and is an events list panel.

3. Once you've added the new panels, drag the panels to rearrange them as you see in the above screenshot.

This is your Flower & Gift Shop Operations dashboard.

View saved dashboards

After you save your dashboards, you can find them in the Search app under Dashboards & Views:

Dash views list 4.3.png

From this list, you can also edit or manage existing dashboards.

Congratulations! You've finished the Splunk Tutorial!

Reporting examples
About data and indexes

This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters