Splunk® Enterprise

Dashboards and Visualizations

Download manual as PDF

Splunk Enterprise version 5.0 reached its End of Life on December 1, 2017. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Edit dashboard panel visualizations

The Visualization Editor provides many features to help create and modify visualizations in a panel. The visualization you choose to represent your data, of course, depends on your search query.

The Visualization Editor is only available for dashboards that use the simplified XML syntax (such as panels that have been created by the Dashboard Editor. Dashboards that have been built with advanced XML syntax can only be edited using an XML editor.

Caution: The Visualization Editor does not check if the visualization you select is appropriate for your search. If you select an inappropriate visualization, you can misrepresent the data returned. For example, if you have a search that returns data in a table, the Visualization Editor allows you to select Single Value to represent the results.

Note: The topics in this section assume familiarity with Splunk visualizations, as described in the "Visualization Reference" in this manual.

About the Visualization Editor

You can only edit panels in dashboards for which you have "write" permissions. If you have read-only access to a dashboard, you cannot change the appearance of any panels in that dashboard. By default you have write permissions for any dashboard that you create using the Dashboard Editor. However, an admin user can change those permissions.

The Visualization Editor is only available for dashboards that have been constructed with the simplified XML syntax. This includes dashboards that were created Using the Splunk Dashboard Editor. For more information on creating dashboards with the Dashboard Editor, see "Create and edit dashboards via the UI," in this manual.

To open the Visualization Editor for a panel in a dashboard:

1. Select Edit: On to enable editing for the dashboard.

2. Select Edit > Edit Visualization for the panel you want to edit.

Features available from the Visualization Editor

Each visualization contains a set of features that you can modify to change the appearance of the visualization. Different charts share many of the same features while other charts can contain a different set of features. This section provides a brief description of the features that you are available for editing.

For details on these features, refer to the "Visualization Reference" in this manual.


The General category includes a title for the visualization and other features specific to that visualization. These include:

  • Stack mode: (Column, Bar, and Area) How to place data in the chart. Options are Not Stacked, Stacked, or Stacked 100%.
  • Drilldown: (Table and all chart visualization types. Not applicable to event lists, single-value visualizations, and gauges.) Enable drilldown functionality for the visualization. In the case of tables, you can enable drilldown for rows or for cells. For more information, see "Understand basic table and chart drilldown actions," in this manual.
  • Null value: (Area, Line) Specifies how Splunk should represent missing Y axis values. Options are Leave gaps, Connect to zero, or Connect to next data point. Leaving gaps means that you don't connect the line or area to datapoints that have a value of 0 or less, or which just connect to the next positive datapoint. If you choose Leave gaps, Splunk displays markers for datapoints that are disconnected because they are not adjacent to other positive datapoints.


X Axis and Y Axis

Many charts have both an X Axis and Y Axis. Some charts, such as Pie, have only a Y Axis.

In the Visualization Editor, you can specify a title for each of these axes. You can also specify the following:

  • Major Unit: Specify the units for tick marks in the axis. For example, 10, 20, or 45... whatever works best.
  • Unit Scale: Specify Linear or Log. Log provides a logarithmic scale which is useful for minimizing the display of large peak values.



Charts typically color code returned results, using a legend to identify the data represented by each color. In the Visualization Editor you can specify the following for Legend:

  • Position: Where to place the legend (or to not include the legend) in the visualization.
  • Truncation: How to represent names in the legend that are too long to display entirely. Specify where to place an ellipsis to represent truncated characters.


Single Value and Gauges

For data returned as a single value, Splunk provides a Single Value visualization and various styles of gauges (Radial, Filler, and Marker). You can specify the following features for these visualizations:

  • Before and After labels: (Single Value) Specify text that appears before or after the returned value.
  • Style: (Radial, Filler, Marker) Specify whether to use minimal graphics to display the gauge.
  • Color ranges: (Radial, Filler, Marker) Specify Automatic or Manual. In Automatic mode, Splunk determines the size and color of returned value ranges. In Manual mode, you can specify colors and the value range they represent.


Data series and visualizations

When creating visualizations for charts, it is useful to think of the returned data in terms of series, a sequence of related data points that can be plotted on a chart. The visualization you choose depends on the type of series.

Series Description
Single series Produces a table with only two columns.
Multiple series Produces a table with three or more columns.
Single value Returns a single value. (Technically, this is not an example of a series.)

Note: "Data structure requirements for visualizations" in this manual provides details on how to select the appropriate visualization for your data and includes discussions on data series.

The following sections describes the charts that best represent data for each of these series. They also provide some examples of how to use the Visualization Editor to create and modify the visualizations.

Visualizations for single series

A single series search is a transforming search that produces a table with only two columns. All chart visualizations can represent a single series search effectively. However, the following charts are usually best:

  • Bar
  • Column
  • Line
  • Pie (Pie charts are only suitable for single series searches)

The following examples use searches from the Flower Shop example, available from the Splunk Tutorial.

Note: You can follow these examples using searches that return similar results.

Column and Pie chart examples

1. Using the Dashboard Editor, create a dashboard with two panels that each specify the following inline search. Specify a time range from -7d to now.The dashboard displays the data in a table.

Views by product category, past week

sourcetype=access_* method=GET | timechart count by categoryId | fields _time BOUQUETS FLOWERS


2. Open the Visualization Editor for the first panel. Select Column from the list of visualizations.

3. Modify the panel title to say:

"Views by product category, past week (Stacked)"

4. For Stack mode, select Stacked. Leave Drilldown enabled.

5. Under General, specify the following:

  • X Axis: Date
  • Y Axis: Views
  • Legend > Position: Bottom
  • Legend > Truncation: A... (To specify how to truncate long labels)
Note: For Y Axis you could specify the units and minimum value, but leave these blank for this visualization. If your data has unusually large peaks, you can specify Log for the unit scale. This minimizes the emphasis on the peaks.

6. Click Save and view the Column visualization.

Turn editing mode off to view the panel. Mouse over the columns to view the tips that appear.

7. Return to editing mode and open the Visualization Editor for the second panel. Select Pie from the list of visualizations.

8. Modify the panel title to say:

"Views by product category, past week (Pie Chart)"

9. For Legend, specify the position at the bottom. Save your edits and turn editing mode off.


Tip: Modify the selections for both of these charts to see how you can change visualizations for a panel.

Example using the wrong visualization

The Visualization Editor does not enforce the correct visualization for a search. For example, for the search in the previous example for Column and Pie Chart, you could have selected Single Value for the visualization even though this cannot represent the returned data correctly. This example illustrates what happens if you select the wrong visualization.

1. In the dashboard from the previous example, add another panel with the same search and place it to the right of the other two panels.

2. For the third panel, select Single Value.

Note: The Panel title field indicates "Error." This is because Single Value does not apply to tabular data.

3. Click Save. Turn off editing mode and view your panels.

The Single Value visualization picks one value to display. Here the error is obvious, but in other examples that incorrectly specify visualizations, it may be easy to overlook errors in the display.


4. Return to editing mode and delete this panel from your dashboard.

Visualizations for multiple series

A multiple series search is a transforming search that produces a table with three or more columns. The following charts are best for a multiple series search:

  • Bar
  • Column
  • Line
  • Area
  • Scatter

The following examples use the same search in the example for single series, but modifies it to return a table with five columns.

Area and Scatter chart examples

1. In the dashboard you created for single series search, add two additional panels that use the following search. Specify a time range of -7d to now</code>. Place the panels side by side in a row beneath the other panels.

Views by product category, past week

sourcetype=access_* method=GET | timechart count by categoryId | fields _time BOUQUETS FLOWERS GIFTS SURPRISE TEDDY

2. For the first panel, select Area from the list of visualizations. Modify the panel title to say:

"Views by product category, past week (Area)"

3. Make the following specifications in the Visualization Editor, then select Save:

  • For Stack mode select Stacked.
  • For Null value select Connect
  • For X Axis specify "Date"
  • For Y Axis specify "Views"


4. For the second panel, select Scatter.

5. Modify the panel to say:

"Views by product category, past week (Scatter Chart)"

6. Select Save.

7. Click Save. Turn off editing mode and view your panels.

Mouse over areas in each panel to see how screen tips provide details for various areas. Click on sections to drilldown to the underlying data.


Single value visualizations

For searches that return single values, Splunk provides the following visualizations that you can specify with the Visualization Editor:

  • Single Value
  • Radial Gauge
  • Filler Gauge
  • Marker Gauge

The following example shows how to represent the value returned from a search using each of these visualizations. It uses the following search, which returns the number of log entries in a Splunk log file.

Splunk server log events

index=_internal source="*splunkd.log" ( log_level=ERROR OR log_level=WARN* OR log_level=FATAL OR log_level=CRITICAL) | stats count as log_events

Note: You must be logged in as an admin user (or a user with admin privileges) to return results from this search.

Single Value, Radial Gauge, Filler Gauge, and Marker Gauge examples

1. Log in as an admin user. In the Dashboard Editor, create a new dashboard named "Displaying single values."

2. Add four panels that use the "log events" search listed above. Name each panel "Splunk server log events." Specify a range from -1d to now. Place the panels in two rows, each with two panels.


3. In the first panel, open the Visualization Editor and make the following edits:

  • For Visualizations, select Single Value. Change the panel title to "splunkd errors logged (Single Value)."
  • For Before label, specify "Only."
  • For After label, specify "events."


Note: The Single Value visualization can display colors, based on the value returned from the search. To display colors, modify the search and edit the underlying XML, as explained in "Single value dashboard display" in this manual.

4. Modify the other panels similarly, selecting the following visualizations. Do not specify labels for these.

  • Radial Gauge
  • Filler Gauge
  • Marker Gauge

5. For the Radial Gauge, click Color ranges and make the following edits, then click Save:

  • Click Manual
  • For Green specify a range from 0 to 200
  • For Yellow specify up to 2000
  • For Red specify up to 5000

Note: Modify the range according to the data returned by your search to give a meaningful visualization.


6. Turn off editing mode and view the panels.


Create and edit dashboards via Splunk Web
Generate dashboard PDFs

This documentation applies to the following versions of Splunk® Enterprise: 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters