Splunk® Enterprise

Dashboards and Visualizations

Download manual as PDF

Splunk Enterprise version 5.0 reached its End of Life on December 1, 2017. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Panel reference for simple XML

Use this Panel Reference for Simple XML when configuring panels for simple XML dashboards and forms.

You can use Splunk's Dashboard Editor and Panel Editors to generate the simple XML configuration for most of these panels. Use this reference when modifying the generated simple XML, or to create dashboards and forms directly in simple XML code. See Create and edit dashboards using Splunk Web for information on creating panels interactively.

The configurations for charts listed in this reference are a subset of the Custom Chart Configuration Reference. Refer to the Custom Chart Configuration Reference for the complete set of options and configurations.

Note: The XML code for the configuration of panels is the same for both simple and advanced XML. This reference uses the <option> tag to specify properties to a visualization. Advanced XML specifies properties using the <param> tag. These tags are interchangeable in both simple and advanced XML code.

General panel configuration

This reference contains the common simple XML configurations for the following types of panels:

Chart
Event
HTML
List
Single value
Table

In simple XML dashboards and forms, panels are placed inside of <row> tags. Typically, a panel represents a visualization of data returned from a search. The exception is the HTML panel, which displays HTML-formatted text.

Here is the basic simple XML code for specifying a panel configuration:

<row>

 <PanelType>
   <title>(Optional) Panel Title</title>
   <!-- (Required, one search specification) --> 
   <searchName>Saved Search Name</searchName>
   <searchString>inline search</searchString>
   <fields>(Optional) comma-separated list of fields</fields>
   <!-- (Optional) one or more options (parameters) to the panel -->
   <option name="option name">Option value</option>
 </PanelType>
 <!-- Up to three panels in a row --> 
 <PanelType>
 . . .
 </PanelType>

</row>

Options to a panel configuration

Options typically apply to specific panels and control the display of information. Some options apply to one or more types of panels, while other apply only to a specific panel type.

This Simple XML Panel Reference lists the common options available to each panel type.See the Custom Chart Configuration Reference for all available options.

Configuration tags that apply to all panels

The following table specifies <tag> configurations that apply to all panels (except the HTML panel).

Tag Description
<title> A title for the panel.

The title display at the top of the panel.

<searchName> Saved search to load in the panel.

Make sure the saved search is shared with all users and roles who access the dashboard. The saved search must exist in savedsearches.conf in the App's default or local directory, the user's directory for private apps, or be set as global.

<searchString> An inline search to run whenever the dashboard loads.
<fields> Comma separated list of fields that restrict your search results to the specified fields.
<earliestTime> Splunk time format that restricts your search results to a specific time window, starting with the earliestTime.

Specify rt to enable real-time searches.

<latestTime> Splunk time format that restricts your search results to a specific time window, ending with the latestTime.

Specify rt to enable real-time searches.

<option name="name"> Options typically apply to specific panels and control the display of information. Some options apply to one or more types of panels, while others apply only to a specific panel type.

This Simple XML Reference lists the common options available for each panel type.

Here's an example of a table panel specifying a basic configuration. It uses an inline search, displays five rows, and disables row numbers.

<table>
  <title>Top sourcetypes in the last 24 hours</title>
  <searchString>
    index=_internal group=per_sourcetype_thruput
    | chart sum(kb) by series | sort -sum(kb)
  </searchString>
  <earliestTime>-1d</earliestTime>
  <latestTime>now</latestTime>
  <option name="count">5</option>
  <option name="displayRowNumbers">0</option>
</table>


Viz SimpleXML ref table.png

Chart panel

The chart panel displays search data in chart format. Pair the chart panel with a saved report you've already created. Saved reports contain chart formatting parameters. Saved searches, on the other hand, do not. For more information, see "Save reports and share them with others" in this manual.

When you load a saved report in the chart panel, your saved report format is also loaded. However, chart formatting can be overridden inline using the chart options.

Charts use named options to specify chart-specific properties. The table below lists a few of these options. See the Custom Chart Configuration Reference for a complete list of chart options.

Note: Splunk uses JSChart, a JavaScript-based charting library, to render charting graphics whenever possible. However, the JSChart library does not support all chart customizations. For customizations not supported by JSChart, Splunk uses the Flash library. This could affect how your graphics display in various devices. For details refer to About JSChart, Splunk's primary charting library.

Chart panel options

Option name Description
charting.chart (bar|line|column|area|pie|scatter|bubble)

Set the chart type.

charting.legend.placement (top|left|bottom|right|none)

Indicates the placement of the legend.

height CSS dimension.

Set the height of the chart.

charting.* All of the formatting options supported for chart

See the Custom Chart Configuration Reference for details.

Chart panel example

Example line chart panel using an inline search. It limits results to a specified time window and provides labels for the X and Y axes.

<chart>
  <title>Top five sourcetypes in the last week</title>
  <searchString>
    index=_internal source="*metrics.log" group=per_sourcetype_thruput
    | timechart sum(kb) by series
  </searchString>
  <earliestTime>-1w</earliestTime>
  <latestTime>-1d</latestTime>
  <option name="height">200px</option>
  <option name="charting.chart">line</option>
  <option name="charting.primaryAxisTitle.text">Time</option>
  <option name="charting.secondaryAxisTitle.text">Count</option>
</chart>


Viz SimpleXML ref chart.png

Event panel

The event panel displays the search results as individual events.

Event panel options

Option name Description
count Integer

The maximum number of rows to display.

displayRowNumbers Boolean

Toggle display of row numbers to the left of results.

entityName (events | results)

Toggle whether to show events or results. Events are individual events, while results are created by statistical operators. Defaults to events.

segmentation (none | inner | outer | full)

Set the segmentation of events displayed. This affects what you can and can't click on within the event.

maxLines Integer

The maximum number of lines to display for each result/event.

showPager (true | false)

Toggle pagination on or off.

Event panel example

Example event panel specifying which fields to display, show the pager, display 20 rows per page, and do not display row numbers.

<event>
  <title>Event view</title>
  <searchString>changelist | head 1000 | dedup changelist</searchString>
  <fields>added deleted changed</fields>
  <option name="showPager">true</option>
  <option name="count">20</option>
  <option name="displayRowNumbers">false</option>
</event>

HTML panel

The HTML panel displays inline HTML. The panel interprets the entire contents between the HTML tags literally, displaying HTML formatted text in the panel.

Any relative link references, such as images, are relative to the current view location. The HTML panel does not accept any options.

HTML panel example

<html>
  <h1>HTML Panel Example</h1>
  <p>The HTML panel displays inline HTML.</p>
  <p>
    The panel interpets the entire contents between the HTML tags literally,
    displaying HTML formatted text in the panel.
  </p>
  <p>
    Any relative link references, such as images,
    are relative to the current view location.
  </p>
  <blockquote>
    <p><b>Note:</b> The HTML panel does not accept any options.</p>
  </blockquote>
</html>


Viz SimpleXML ref html.png

List panel

The list panel displays data in a list. Use this panel to display information from saved searches or search results. This panel supports the following options.

List panel options

Option name Description
labelField (Required) Field name

The field you want to use to generate labels for your list.

valueField Required. Field name

The name of the result field whose value should be displayed in the label part of the link list. Link lists are generally a combination of a descriptive label and a numeric count or other (value) field.

initialSortDir (asc | desc)

The direction to sort the results based on the initialSort field.

labelFieldSearch Search string

The search string to generate when the user clicks on the label field. Requires labelFieldTarget to be defined to a valid view. The value of the label field is automatically added to the search.

labelFieldTarget View name

The view to target if the label field is set up to generate a clickable link that dispatches a search.

initialSort Field name

The field in the result set to sort on when the link list is first rendered.

List panel example

Example list panel listing the sourcetype for errors, followed by host name for the error:

<list>
  <searchName>Errors in the last 24 hours</searchName>
  <option name="labelField">sourcetype</option>
  <option name="valueField">host</option>
</list>

Single value panel

The single value panel displays the results of a search that return a single value.

Note: If you specify a search that returns multiple values, the single value panel displays the value from either the first row or first column of returned search data.

You can change the color of the panel by specifying a rangemap for the returned values.

Single value panel options

Option name Description
additionalClass CSS class name

An additional css class name to add to the result container.

linkView Name of a view.

Specify which view to execute the linked search against. Defaults to dashboard.

field Field to display.

Defaults to first field returned.

linkFields (result | beforeLabel | afterLabel)

Set which part of the text in the single value to use as a link. To link the result and both labels, set as result,beforeLabel,afterLabel. Defaults to result

classField (class | severe | elevated | low| None) Default is None.

Adds the value of the classField of the first result as an additional CSS class to the result container. Pre-defined classes include:

severe
high
elevated
guarded
low
None
beforeLabel Text

Label to display before the result.

afterLabel Text

Label to display after the result.

linkSearch Search query

A valid complete search query to turn the result into a clickable link.

Single value panel examples

Example single value panel displaying before and after labels, and specifying a color range. The range map in the search specifies the values for each range. This panel uses the Splunk default colors for a range map.

<single>
  <searchString>
      index=_internal source="*splunkd.log" ( log_level=ERROR 
      OR log_level=WARN* OR log_level=FATAL 
      OR log_level=CRITICAL) | stats count as log_events 
      | rangemap field=log_events low=1-100 elevated=101-300 default=severe
  </searchString>
  <title>Log events</title>
  <earliestTime>-1d</earliestTime>
  <latestTime>now</latestTime>
  <option name="classField">range</option>
  <option name="afterLabel">total logging events</option>
  <option name="beforeLabel">Found</option>
</single>


Viz SimpleXML ref single.png


Example single value panel that shows how to implement a custom "drilldown" action for a single value. The options linkFields, linkView, and linkSearch are all required to implement the drilldown. Clicking on the returned value opens the timeline view with the specified search.

<single>
  <title>Single value: custom drilldown</title>

  <searchString>
    index=_internal source="*splunkd.log"
    ( log_level=ERROR OR log_level=WARN* OR log_level=FATAL OR log_level=CRITICAL)
    | stats count as log_events
  </searchString>

  <earliestTime>-1d</earliestTime>
  <latestTime>now</latestTime>

  <option name="beforeLabel">Found:</option>
  <option name="afterLabel">Splunk server log events</option>
  <option name="count">10</option>
  <option name="displayRowNumbers">true</option>
  <option name="linkFields">result</option>
  <option name="linkView">flashtimeline</option>
  <option name="linkSearch">
    search index=_internal source="*splunkd.log"
    (log_level=ERROR OR log_level=WARN* OR log_level=FATAL OR log_level=CRITICAL)
  </option>
</single>

Table panel

The table panel displays search data as a table.

Table panel options

Option name Description
count Integer

The maximum number of rows to display.

displayRowNumbers Boolean

Toggle display of row numbers to the left of results.

showPager Boolean

Show paging in the table.

Table panel example

Example of a table panel using an inline search, displaying five rows, and disabling row numbers.

<table>
  <title>Top sourcetypes in the last 24 hours</title>
  <searchString>
    index=_internal group=per_sourcetype_thruput
    | chart sum(kb) by series | sort -sum(kb)
  </searchString>
  <earliestTime>-1d</earliestTime>
  <latestTime>now</latestTime>
  <option name="count">5</option>
  <option name="displayRowNumbers">0</option>
</table>


Viz SimpleXML ref table.png

PREVIOUS
Chart customization
  NEXT
Overview of the custom chart configuration reference

This documentation applies to the following versions of Splunk® Enterprise: 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters