Splunk® Enterprise

Dashboards and Visualizations

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Workflow for creating dashboards

The Splunk platform has many tools for presenting data in a dashboard.

You can use the following workflow to create a dashboard.

  1. Add content
    Create searches to drive the dashboard.
  2. Design the user interface
    Generate visualizations and other content for the dashboard panels.
  3. Add interactivity
    Use a drilldown to add interactivity to the dashboard.
  4. Customize the dashboard
    Add customized features to the dashboard.

Add content

Searches power dashboards. The following resources can help you create and use searches in dashboards.

  • Create searches to power dashboards
    Create searches to highlight the most relevant aspects of your data and support your user's goals. If you have never worked with Splunk's search language before, read the introductory section to the Search Manual. The Search Reference provides additional information on creating Splunk platform searches.
  • Searches saved as reports
    You can save a search as a report and then access the search in a dashboard by reference to the report. For more information, refer to the Reporting Manual. The Reporting Manual contains a section "Create and edit reports" which provides details.
  • Generate searches with Pivot
    You can use the Pivot tool to generate searches as pivots that can be exported to reports or to dashboards. Using data models, Pivot enables you to identify data sets and to design tables, charts, and other visualizations based on the structure of the data set.

For more information:

Design the user interface

The Splunk platform provides various interactive editing tools that you can use to design your dashboards. You can create dashboards directly from the Dashboard Editor. You can add panels to a new or existing dashboard from Search, Report, or Pivot. You can add panels from existing dashboards or that were created for reuse.

Within the Dashboard Editor you can drag and drop panels to reposition them within your layout. You can access the Visualization Editor dialogs to change the title of panels, configure the visualization of data, and edit the searches that power a panel.

For more information:

Add interactivity

Add interactivity to a dashboard with forms. To create a form, edit the dashboard Simple XML source code.

Drilldown offers additional interactive functionality for dashboards.

You can use dynamic drilldown to specify linking to other resources. With dynamic drilldown, you can send parameters to forms or third party web pages to drive the content of the destination. To implement dynamic drilldown, edit the source code of the dashboard or form.

For more information:

Customize the dashboard

There are several extension points to simple XML that you can use to modify the layout, add new visualizations, and customize behavior of dashboards. With these customizations, you can created compelling views for your content.

You implement these customizations using various combinations of custom stylesheets, JavaScript, and simple XML code.

  • CSS styles
    Add custom stylesheets for individual dashboards in an app.
  • Layout
    Make simple layout changes, such as rearranging dashboard and form elements and hiding panels.
  • Tokens
    Set custom tokens throughout the dashboard page.
  • Custom visualizations
    Build custom visualizations as dashboard panels.
  • Table cell renderers
    Specify custom styles and behavior within table cells.

For more information:

Dashboards and forms
Dashboard Examples App

This documentation applies to the following versions of Splunk® Enterprise: 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters