Splunk® Enterprise

Dashboards and Visualizations

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Edit dashboards with the Dashboard Editor

This topic shows you the basics of building dashboards and forms with the Dashboard Editor. The Edit Visualizations topic describes how to create and modify visualizations for dashboard panels.

Panels, searches, dashboards, and forms

A dashboard contains one or more panels. Add inputs to the dashboard to create a form.

Typically, you organize multiple panels in rows. A search powers the contents of each panel, which displays the results as a table or a visualization.

The search that powers a panel can come from a variety of sources:

  • Inline search specified for that panel.
  • Inline pivot specified for that panel.
  • Search from a report
    The panel contains a reference to the report, which contains the search.
  • Search from a pivot
    The panel contains a reference to a report, which contains the pivot.

From a form or dashboard, you can have a global search that applies to all panels. Within each panel, you can use a post process search to modify the global search and display the results differently.

Add panels

The procedure to add a dashboard is available from the Edit menu for a dashboard. You can access the Edit menu directly from the dashboard or from the list of dashboards on the Dashboards page.

To add panels to a dashboard:

  1. For a dashboard, select Edit > Edit Panels.
  2. Select Add Panel.
  3. (Optional) Provide a title for the panel.
  4. Specify the content type: inline search, inline pivot, or report. Click Add Panel.
  • Inline search
    Specify a search string and a time range. You can run the search before adding the panel.
  • Report
    Select from the reports available to this app. Reports can be based on searches or pivots. The dialog displays the search string or pivot from the report, but you cannot edit the search from this dialog.

To rearrange panels for a dashboard:

  1. If you are not in edit mode for the dashboard, select Edit > Edit Panels.
  2. Grab a panel and drag it to its new position.

Create a form

Adding inputs to a dashboard converts the dashboard to a form.

To create a form:

  1. Create a dashboard with one or more panels.
  2. From the Add Form menu, select one or more inputs.
  3. For each input added, edit the input to specify the input behavior.
  4. (Optional) Drag and drop the inputs to rearrange them in the newly created form.
  5. (Optional) Drag an input into a panel to specify an input applicable only to that panel.

For details on creating and editing forms, see Create and edit forms with the Dashboard Editor.

Edit panels for a dashboard

The tools available to edit a panel depend on the search that powers the panel. Panels can be based on the following searches. The Panel Editor displays an icon for each type of base search.

Icon Search
InlineSearchIcon.png Inline search
InlinePivotIcon.png Inline pivot
SearchReportIcon.png Search from report.
PivotReportIcon.png Pivot from report

To edit the search that powers a dashboard panel:

  1. If you are not in edit mode for the dashboard, select Edit > Edit Panels.
    Each panel displays three editing icons for modifying the contents of the panel.
  2. Select the Panel Properties icon.
    The options available to you depend on the type of base search.
All panel types
  • Edit the title for the panel.
  • Delete the panel.
Reports
  • View the report.
  • Open the search in Search or Pivot.
  • Clone to an inline search or pivot.
  • Select a different report for the panel.
  • Select the visualization specified in the report for this panel.
Inline searches and inline pivots
  • Edit the search specifying the inline search or inline pivot.
  • Convert the inline search or pivot to a report.
For more information on searches, reports, and pivots refer to:

To change the visualization for a panel:

  1. If you are not in edit mode for the dashboard, select Edit > Edit Panels.
  2. Click the Visualization icon, and select a visualization. The graphic for the Visualization icon reflects the type of visualization currently selected.

    Splunk lists visualizations available, noting which ones are recommended for the base search.

    If the search is a pivot or a pivot report, you cannot change the visualization for the panel. Instead, use the Pivot Editor to modify the visualization. See Design pivot charts and visualizations with the Pivot Editor for details.

To configure the visualization for a panel:

  1. If you are not in edit mode for the dashboard, select Edit > Edit Panels.
  2. Click the Visualization Formatting icon.
    The properties available to configure depend on the visualization selected.
  3. Configure the visualization.
    See Properties available from the Visualization Editor for details on formatting visualizations.

Edit the source code for a dashboard

You can also access and edit the source code for a dashboard and the panels it contains. For dashboards based on simple XML, edit the source code to access features not available from the Dashboard Editor. For dashboards based on HTML, this is the only way you can edit the dashboard without using a third party editor.

To edit the source code for a dashboard:

  1. From a dashboard, select Edit > Edit Source.
    Splunk lists the type of a dashboard when listing the editing options.

For information about editing simple XML source code see the chapter Building dashboards using simple XML.

For information about editing dashboards converted or exported to HTML, see convert a dashboard to HTML.

Convert a simple XML dashboard to HTML

By default, Splunk creates dashboards that are based on simple XML code. You can convert or export a dashboard so it is based on HTML that accesses SplunkJS Stack.

Note: You cannot use Splunk's visual editors to edit HTML dashboards. Integrated PDF generation is not available for HTML dashboards.

To convert the source code for a dashboard to HTML:

  1. From a dashboard, select Edit > Convert to HTML.
  2. Specify the following, then click Convert Dashboard:
  • Select Create New or Replace Current
    If you replace the current dashboard, the underlying simple XML is no longer available. Splunk recommends that you create a new dashboard, preserving the original simple XML code.
  • Title
  • ID
  • Description
  • Permissions
    After converting the dashboard, you have an opportunity to further edit the permissions.

For more information about converting simple XML source code to HTML and then editing the exported HTML, see convert a dashboard to HTML.

Clone a dashboard

You can clone a dashboard to create a copy of it based on an existing dashboard. The procedure to clone a dashboard is available from the Edit menu for a dashboard. You can access the Edit menu directly from the dashboard or from the list of dashboards on the Dashboards page.

To clone a dashboard:

  1. For the dashboard you want to clone, select Edit > Clone.
  2. Provide a new Title, ID, and Description. Click Clone Dashboard.
  3. After Splunk clones the dashboard, you have the following options:
  • View and set permissions for the dashboard.
  • Schedule PDF delivery for the dashboard.

Delete a dashboard

The procedure to delete a dashboard is available from the Edit menu for a dashboard. You can access the Edit menu directly from the dashboard or from the list of dashboards on the Dashboards page.

To delete a dashboard:

  1. For the dashboard you want to delete, select Edit > Delete.
  2. Confirm that you want to delete the dashboard and click Delete.

Schedule PDF delivery of a dashboard

You can schedule PDF delivery for a dashboard from the Edit menu for a dashboard. You can access the Edit menu directly from the dashboard or from the list of dashboards on the Dashboards page.

Note: PDF delivery is only available for dashboards based on simple XML. You cannot schedule PDF delivery for dashboards converted or exported to HTML.

To schedule PDF delivery of a dashboard:

  1. For the dashboard you want to schedule, select Edit > Schedule PDF Delivery.
  2. Toggle the Schedule PDF Delivery check box to enable or disable PDF delivery.
  3. If you enable PDF delivery, you can specify the following options:

    Schedule
    Email addresses for delivery
    Subject line for email delivery ($name$ specifies the Title of the dashboard.)
    Paper Size
    Paper Layout
  4. (Optional) You can send a test email or view a sample PDF before scheduling delivery.
  5. Click Save to save your PDF delivery settings.

For more information, see Generate dashboard PDFs.

Change the app context for a dashboard

You create dashboards within the context of an app. Unless you set global permissions for the dashboard, it is not available from other apps. However, you can change the app context for a dashboard. This is essentially moving the dashboard from one app to another.

Note: Your ability to perform this operation depends on your user role and capabilities.

To change the app context for a dashboard:

  1. From Splunk Web, select Settings > User interface > Views.
  2. Locate the dashboard you want to move, and for Actions, select Move.
  3. Select an app context. Click Move.

Specify navigation for an app

You can add a dashboard to the navigation bar for an app, create a group of dashboards as a dropdown list from the navigation bar, and specify a default view for an app. To perform this procedure, edit the navigation menu XML from the Splunk Settings menu. You must have the appropriate user role and capabilities to access this feature.

Note: Navigation is managed on an app by app basis. If your dashboard has been promoted globally to all of the apps in your system, it initially appears in the default drop-down list for "unclassified" views in those apps' top-level navigation menus. Users with write permissions for those apps can move the dashboard to its proper location in the app navigation menus as appropriate.

To access the navigation menu XML for an app:

  1. From any Splunk view, select Settings > User interface > Navigation menus.
  2. Select the app from App context.
  3. If necessary, select the user role from Owner.
    The user roles depend on the permission configuration for the app.
  4. Under Nav name, select default to open the navigation menu XML in the Splunk Source editor.
    Edit the navigation menu XML, as described below.

Add a dashboard to the navigation bar

You can add a dashboard to the navigation bar by listing it with the <view> element as a child of the <nav> element. The following example shows how to add a dashboard (my_dashboard) to the default views of an app's navigation bar.

<nav search_view="search" color="#993300">
  <view name="search" default='true' />
  <view name="data_models" />
  <view name="reports" />
  <view name="alerts" />
  <view name="dashboards" />
  <view name="my_dashboard"/>
</nav>

The name attribute to the <view> element specifies the ID of the dashboard. When you create a dashboard, you specify this ID. The dashboard ID specifies the leaf node of the URL that accesses the dashboard.

Use the <collection> element to create a dropdown list of dashboards to the navigation bar.

 <view name="search" default="true"/>
 <view name="data_models" />
 <view name="reports" />
 <view name="alerts" />
 <view name="dashboards"/>
 <collection label="Shadow Dashboards">
   <view name="my_dashboard"/>
   <view name="my_other_dashboard"/>
 </collection>

</nav>

Specify a default view for an app

You define the default view for an app with the default attribute to the <view> element. A view so designated becomes the home view for the app. By default, the Search view is the home view of an app.

For example, to specify the Reports view as the home view:

  <view name="reports" default="true"/>

To specify a default view for drilldown: You define the default view for drilldown behavior in an ap with the search_view attribute to the <nav> element. This becomes the home view for the app. For drilldown behavior, dashboards in the app link to the specified view unless you customize drilldown behavior for a panel.

Note: Typically, users expect the Search view for drilldown behavior. Be careful before changing this default behavior.

Specify a color for the navigation bar for an app

Use the color attribute for the <nav> element to specify the color of an app's navigation bar. For example:

  <nav search_view="search" color="#993300">

Legacy advanced XML dashboards

Splunk encourages you to migrate from legacy advanced XML to simple XML and to use exported HTML to provide features not supported by simple XML.

However, you can export simple XML to advanced XML to view the advanced XML implementation. Splunk no longer supports conversion of the dashboard to advanced XML.

Export a simple XML dashboard as advanced XML

For simple XML dashboards created using Splunk Enterprise 6.0 or earlier, you can export the dashboard as advanced XML.

Note: For simple XML dashboards created with Splunk Enterprise 6.1 or later, the generated advanced XML may not reliably represent the underlying implementation of the dashboard.

1. From the Dashboard list page, open the dashboard to export.

The dashboard must be implemented in simple XML.

2. Append the REST parameter showsource=advanced to the URL for the dashboard.

For example, if you implemented the following dashboard in simpleXML
http://localhost:8000/en-US/app/bubbles/flower_shop_dashboard
Specify the following to view the XML source for the dashboard:
http://localhost:8000/en-US/app/bubbles/flower_shop_dashboard?showsource=advanced

3. View the advanced XML implementation.

View the source of an advanced XML dashboard

1. Open the advanced XML view.

2. Append the REST parameter showsource=1 to the URL for the dashboard.

3. View the advanced XML implementation.

PREVIOUS
About the Dashboard Editor
  NEXT
Create and edit forms with the Dashboard Editor

This documentation applies to the following versions of Splunk® Enterprise: 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters