Splunk® Enterprise

Dashboards and Visualizations

Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Splunk dashboards and forms

Every page in a Splunk app is a view. For example, the search timeline page in the Search and Reporting app is a default view that ships with that app. If you design your own apps you can construct views for them. You can also add views to existing apps.

Dashboards are the most common types of views. Each dashboard contains one or more panels, each of which can contain visualizations such as charts, tables, event lists, and maps. Each dashboard panel uses a base search to provide results for the visualizations. Typically, the search returns results when the dashboard is loaded.

A form is a dashboard that provides user inputs to the search, such as a dropdown list, radio buttons, or a text box. A form contains the same options for panels and visualizations that are available for dashboards.

Dashboards and forms can also modify a search (post process the search) to extract and highlight different information from the search in the panels.

Anatomy of dashboards and forms

Dashboards and forms are the two type of views you can create with simple XML. Their underlying structure is essentially the same, except for a few minor differences. The following simple XML elements make up a dashboard or form. Many of these elements are optional. Refer to the Simple XML Reference for a detailed description of the underlying simple XML.

  • Top-level element
    <dashboard> or <form>
  • Title
    <label> (Optional)
  • Description
    <description> (Optional)
  • Global search
    <searchTemplate> (Optional)
  • Time range for the global search
    <earliestTime> (Optional)
    <latestTime> (Optional)
  • Form inputs (Forms only)
    <fieldset><input>
    <dropdown>
    <radio>
    <text>
  • Rows
    Each row contains one or more panels.
    <row>
  • Panels
    Each panel contains a visualization of search results.
    <chart>
    <event>
    <list>
    <map>
    <single>
    <table>
  • Searches defined for panels
    <searchName>
    <searchString>
    <searchPostProcess>

Differences between dashboards and forms

The main differences between a dashboard and a form in simple XML are:

  • Each has a different top-level element, <dashboard> and <form>.
  • Forms have user inputs, such as a time range picker, dropdown lists, radio group, or a text box.
  • Forms often take advantage of post process searches, although you can also do this in a dashboard.
  • The order of simple XML elements differ slightly in the source code.

Otherwise, the layout of rows, panels, and the visualizations in the panels is essentially the same.

For details on the underlying simple XML, in the Simple XML Reference compare the entries for <dashboard> and <form>.

More about views

In simple XML, you can define a view as a dashboard or a form. However, Splunk supports other types of views.

  • Advanced XML views
    Dashboards created in legacy advanced XML define views according to imported Mako templates. Additional views besides dashboards and forms are available including views from custom Mako templates. For more information, see Layout templates for advanced XML.
  • HTML plus SplunkJS Stack
    You can convert a simple XML view to HTML that accesses SplunkJS Stack. After the conversion, the concept of a dashboard or form view, as defined in simple XML, no longer applies.

Editors for Splunk dashboards

Splunk provides various options for creating and editing dashboards, and also the visualizations contained within dashboards.

Note: This section provides an overview of the options available. For details about using Splunk tools for creating and editing dashboards, see Create and edit dashboards from Splunk Web.

Dashboard Editor

Use the Dashboard Editor to create new dashboards, add panels to dashboards, edit existing dashboards, and generate PDFs for a dashboard. The Dashboard Editor includes a series of editing dialogs that fall under the umbrella term of "editor."

  • Panel Editor
    When you enable a dashboard for editing, you can access a series of dialogs pertaining to each panel. From the Panel Editor, you edit the panel properties, access or edit the panel's underlying search, change the visualization, and configure the visualization.
  • Visualization Editor
    Editing dialogs that allow you to configure the visualization. The contents of the editing dialog changes, depending on the nature of the visualization. Similar editing dialogs are available from the Splunk Search page and Report page. From Search and Report you can define visualizations that you export to a dashboard.

Access dashboards from Search, Report, or Pivot

You can create dashboards, or add panels to a dashboard, when saving a search, report, or pivot.

Pivot Editor

From Pivot you can access the Pivot Editor, a robust tool for creating and editing visualizations. Pivot Editor provides more options for defining a visualization than the Visualization Editor because it matches properties in the visualization with their definition in the pivot. For more information, See Design Pivot Charts and Visualizations with the Pivot Editor for details.

Splunk Source Editor

For many features, you need to edit the source simple XML code. Splunk provides a source editor that you can use to edit either simple XML or HTML.

When you edit the simple XML for a dashboard you can do the following:

  • Control a much wider range of dashboard panel formatting properties. Use the custom chart configuration reference to customize the appearance of your charts and gauges.
  • Create geographic maps that display location markers.
  • Configure advanced, dynamic drilldown behaviors (such as drilldown clicks that take users to a second dashboard).
  • Create HTML panels that display static text, images, and HTML formatting.
  • Configure panels where you overlay charts. Splunk's charting library includes special chart types designed specifically for overlay purposes.
  • Design forms that:
    • Include text boxes, dropdown lists, and dynamic radio buttons.
    • Have different searches for each panel that all make use of the input from the form controls (text box, list, or radio button)
    • Make use of post-process searches (searches whose results are "post-processed" by child panels, using reporting commands like timechart, chart, and stats).
    • Auto-run on page load with a default value. Users can rerun the page after it loads with different values if they wish.

To learn how to create more sophisticated dashboards with simple XML, start with Build and edit dashboards with simple XML in this manual.

To learn how to create forms with simple XML, see Build and edit forms with simple XML in this manual.

Your favorite source code editor

You may elect to use your favorite source code editor to edit the source code for a dashboard. In addition to editing simple XML or HTML source, you may want to edit CSS or JavaScript files accessed by the dashboard.

In this scenario you need access to the Splunk instance on the host server. See About editing simple XML for more information.

Last modified on 28 June, 2016
PREVIOUS
Splunk Web Framework
  NEXT
Workflow for creating dashboards

This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters