Splunk® Enterprise

Dashboards and Visualizations

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

About the Dashboard Editor

The Dashboard Editor enables you to create and edit dashboards without writing a single line of XML code. From the Dashboard Editor you can do the following:

  • Create dashboards and then populate them with panels.
  • Add a time range picker.
  • Rearrange dashboard panels using a drag-and-drop interface.
  • Edit the search that powers the panel and panel details, such as the title.
  • Specify different visualizations for a panel.
  • Specify formatting options for a panel visualization.
  • Edit the source code for a dashboard.
  • Convert a dashboard as HTML.

Open the Dashboard Editor

To create a new dashboard:

  1. From the Dashboards page of an app, click Create New Dashboard.
    You create dashboards from the context of an app. After you create a dashboard, you can modify the permissions to specify who has access to the dashboard. You can also move the dashboard to another app context.
  2. Provide a Title, ID, and Description. Specify permissions. Then click Create Dashboard.
  3. Add panels, add an input, or edit the source code for the dashboard to proceed.
    Refer to Edit dashboards with the Dashboard Editor for details on editing dashboards.
  4. Click Done when you are finished creating the dashboard.

To edit an existing dashboard:

  1. From the Dashboards page of an app, click an existing dashboard.
  2. Click Edit to view the options to edit the dashboard.
    Refer to Edit dashboards with the Dashboard Editor for details on editing dashboards.

Add a search, report, or pivot to a dashboard

You can add a search, report, or pivot as a panel to a new or existing dashboard.

You can add a panel directly from the Search, Reports, or Pivot pages.

  • From a Search page or from a Pivot, click Save As > Dashboard Panel.

  • From the Report page, click Add to Dashboard.

The options available to save a dashboard panel vary, depending on the source (Search, Reports, or Pivot) and whether you are creating a new dashboard or adding a panel to an existing dashboard.

Caution: Permissions change when accessing a report as a dashboard
When you create a report, your user context determines the permissions to access the search for the report. When you then save the report as a panel in a dashboard, the permissions to access the search changes, allowing other users to access results that otherwise were available only to the creator of the report. This can result in unintended exposure of data in a dashboard.

For example, a user with the role admin user can view the contents of the _internal index. A user with the role user does not have permission to view this index.

If an admin user creates a report on the following search, with permissions shared, only an admin user can access the results of the report.

index=_internal | top sourcetype

But if you save the report as a dashboard, with permissions shared, a user with the role user can access the results from the index _internal. From the report, this user would not have permission to view the contents of _internal.

Additionally, a user with role user can create a dashboard to access the report, and thus view the contents of _internal.

Specify visualizations for the dashboard panel

When you run a new search or open a report, the visualizations recommended to you depend on the results of the search. If the search does not include transforming commands, only the events list is recommended. Additionally, if you ran the search in Verbose Mode, you can view a listing of events for the search, even if the search is a reporting search.

When you add the search to a dashboard panel, you select how the panel displays the results. You can later change your selection from the Dashboard Panel Editor.

For more information, see Edit dashboards with the Dashboard Editor.

Specify dashboard permissions

When creating a dashboard, you specify the following permissions for the dashboard from the Create Dashboard Panel:

  • Private
    Only you have permissions to view and edit the dashboard.
  • Shared in App
    The dashboard is available to other users from the app in which you created the dashboard. Other users can view the dashboard, and depending on their permissions, edit the dashboard.

After creating a dashboard you can change the permissions.

  1. From the Dashboards page, locate the dashboard for which you want to edit permissions.
  2. Under Actions, select Edit > Edit Permissions
  3. Specify the following:

    • Display for Owner, App, or All Apps
    • Read and write privileges for users
      Your user role, and capabilities defined for that role, can limit the type of access you can define.

More about dashboard permissions

A dashboard is a knowledge object in Splunk and you manage its permissions accordingly. Your user role (and capabilities defined for that role) may limit the type of access you can define.

For example, if your Splunk user role is "user" (with the default set of capabilities), then you can only create dashboards that are private to you. You can, however, provide read and/or write access to other users.

If your Splunk user role is "admin" (with the default set of capabilities), then you can create dashboards that are private, visible in a specific app, or visible in all apps. You can also provide access to other Splunk user roles.

For additional information on setting up permissions for dashboards and other knowledge objects refer to Manage knowledge object permissions in the Admin manual.

Edit permissions example

The following example shows how an admin user can specify permissions for a dashboard.

Note: For other user roles, such as "user," the choices for permissions in the Dashboard Editor are a subset of the choices available to the admin user.
  1. For a dashboard, select Edit then select Edit permissions
  2. Specify permissions for the dashboard and click Save. Choose from the following:
  • Owner: The dashboard is only visible to the user who created it.
  • App: Dashboards can be visible only for the app in which it was created. Specify the read and write permissions for user roles.
  • All apps: The dashboard is visible from all apps. Specify the read and write permissions for user roles.

Convert a dashboard to a form

The underlying simple XML for a form differs slightly from the simple XML for a dashboard. There are two ways to convert a dashboard to a form: add a time picker to a dashboard to convert it to a form, or edit the source simple XML for a dashboard to include form elements.

Splunk recommends the following workflow for creating and editing forms:

  1. First use the Dashboard Editor to create and lay out the panels.
  2. Edit the panels, searches, and visualizations in the Dashboard Editor to fine tune the dashboard.
  3. (Optional) Add a time range picker to the dashboard.
    Splunk converts the underlying simple XML to support a form.
  4. Edit the simple XML to add form elements.
    Replace the top-level <dashboard> element with a <form> element, and then add elements that define form inputs.

Customize a dashboard

There are several options to customize a dashboard, adding features not available from the Dashboard Editor.

  • Edit the underlying simple XML to implement advanced features.
    Typically, you edit the simple XML when converting the dashboard to a form, or to edit visualization features that are not available from the interactive editors. You can also take advantage of tokens from search strings to customize the appearance of text. See About editing simple XML for more information.
  • Convert or export the dashboard as HTML.
    After converting the dashboard, edit the HTML code, JavaScript, and style sheets to specify custom behavior. See Convert a dashboard to HTML for more information.
  • (Legacy) To implement legacy features from Splunk's module system, use the showsource=advanced REST parameter to the URL to view the underlying advanced XML. Copy the advanced XML to a file and implement legacy features from the module system. See About advanced XML for more information.
Splunk SDKs
Edit dashboards with the Dashboard Editor

This documentation applies to the following versions of Splunk® Enterprise: 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters