Splunk® Enterprise

Dashboards and Visualizations

Download manual as PDF

Splunk Enterprise version 5.0 reached its End of Life on December 1, 2017. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Overview of simple XML

Splunk's simple XML syntax allows you to create basic dashboards. The following sections of this chapter walk you through the steps of developing a dashboard using simple XML. Here are some of the basics of simple XML:

  • <dashboard> is the base tag of a dashboard. XML files implementing dashboards are wrapped in these tags.
Use the refresh attribute to set how frequently, in seconds, to refresh the dashboard. For example, <dashboard refresh="30"> sets the refresh rate to 30 seconds.
  • <form> is the base tag of a dashboard that accepts user input to define the search displayed in the dashboard.
For dashboards that accept user input, do not use the <dashboard> tag. Instead, use the top-level <form> tag. See Build and edit forms with simple XML for details on building forms.
  • <label> is a child tag of <dashboard>. It specifies the display name of the dashboard.
  • Dashboards present panels in rows, designated by the <row> tag. Each row can contain up to three panels.
  • Each panel is a visualization of data returned by the panel's search. Here are common visualizations for panels:
<event>: Displays a list of events.
<table>: Displays data in a table.
<chart>: Displays returned data in a chart. <option> tags define the type and layout of the chart.
  • Child tags to a panel include:
<searchName>: specifies a saved search.
<searchString>: specifies an inline search specific to that panel.
<title>: Display name for the panel.
<earliestTime>, <latestTime>: specifies the time range for the search.
  • <option> tags to a panel that define the type and properties of the panel visualization. For example:
<option name="charting.chart">pie</option> specifies a pie chart for the visualization type.
<option name="count">12</option> specifies to display 12 rows in a table.


See the Splunk Panel Reference for details on specifying visualizations for panels.

Panels available for dashboards

With simple XML, you can specify the type of visualization to display in a panel. The visualizations available include the following:

  • Charts
  • Tables
  • Lists
  • Single button
  • Events
  • HTML

The panel reference lists all visualizations plus includes examples of the underlying Simplified XML.

Advanced XML

Most of the documentation in this manual describes creating and editing dashboards using simple XML. Simple XML sits on top of Splunk's advanced XML implementation. Complex dashboards and forms might need to leverage functionality only available from advanced XML.

You can always convert simple XML to advanced XML. However, you cannot later go back to simple XML. Splunk recommends that you start advanced projects in simple XML, and then convert them later to advanced XML to add the more complex features.

About Advanced XML provides details on editing Advanced XML.

To convert simple XML to advanced XML, in Splunk Web use the showsource URI. For example:

http://localhost:8000/en-US/app/<app_name>/<dashboard_name>?showsource=true

Special characters in XML files

Some characters have special meaning in an XML file and cannot be used literally. You can wrap the text within CDATA tags as illustrated below. The XML parser does not process text within CDATA tags.

<![CDATA[
 <code>"Text within a CDATA tag"</code>
]]>

Or you can escape these characters using HTML entities:

Character HTML Entitiy
"
&quot;
'
&apos;
<
&lt;
>
&gt;
&
&amp;
PREVIOUS
Generate dashboard PDFs
  NEXT
Build and edit dashboards with simple XML

This documentation applies to the following versions of Splunk® Enterprise: 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters