Dashboards and Visualizations

Dashboards and forms

Every page in a Splunk app is a view. For example, the search timeline page in the Search and Reporting app is a default view that ships with that app. If you design your own apps you can construct views for them. You can also add views to existing apps.

Dashboards are the most common types of views. Each dashboard contains one or more panels, each of which can contain visualizations such as charts, tables, event lists, and maps. Each dashboard panel uses a base search to provide results for the visualizations. Typically, the search returns results when the dashboard is loaded.

A form is a dashboard that provides user inputs to the search, such as a dropdown list, radio buttons, or a text box. A form contains the same options for panels and visualizations that are available for dashboards.

Dashboards and forms can also modify a search (post process the search) to extract and highlight different information from the search in the panels.

Anatomy of dashboards and forms

Dashboards and forms are the two type of views you can create with simple XML. Their underlying structure is essentially the same, except for a few minor differences. The following simple XML elements make up a dashboard or form. Many of these elements are optional. Refer to the Simple XML Reference for a detailed description of the underlying simple XML.

• Top-level element
  <dashboard> or <form>

• Title
  <label> (Optional)

• Description
  <description> (Optional)

• Global search
  <searchTemplate> (Optional)

• Time range for the global search
  <earliestTime> (Optional)
  <latestTime> (Optional)

• Form inputs (Forms only)
  <fieldset><input>
  <dropdown>
  <radio>
  <text>
  
  

• Rows
  Each row contains one or more panels.
  <row>

• Panels
  Each panel contains one or more visualizations.
  <panel> (Optional)

• Visualizations
  A visualization provides a chart, table, or listing of search results.
  <chart>
  <event>
  <list>
  <map>
  <single>
  <table>

• Searches defined for panels
  <searchName>
  <searchString>
  <searchPostProcess>

Differences between dashboards and forms

The main differences between a dashboard and a form in simple XML are:

• Each has a different top-level element, <dashboard> and <form>.

• Forms have user inputs, such as a time range picker, dropdown lists, radio group, or a text box.

• Forms often take advantage of post process searches, although you can also do this in a dashboard.

• The order of simple XML elements differ slightly in the source code.

Otherwise, the layout of rows, panels, and the visualizations in the panels is essentially the same.

For details on the underlying simple XML, in the Simple XML Reference compare the entries for <dashboard> and <form>.

More about panels

Panels contain the visualizations that display data in a dashboard or form. Either an inline search or the search from a report drives the content of the visualizations.

More about views

In simple XML, you can define a view as a dashboard or a form. However, Splunk supports other types of views.

• Advanced XML views
  Dashboards created in legacy advanced XML define views according to imported Mako templates. Additional views besides dashboards and forms are available including views from custom Mako templates. For more information, see Layout templates for advanced XML.

• HTML plus SplunkJS Stack
  You can convert a simple XML view to HTML that accesses SplunkJS Stack. After the conversion, the concept of a dashboard or form view, as defined in simple XML, no longer applies.

Editors for Splunk Enterprise dashboards

Splunk provides various options for creating and editing dashboards, and also the visualizations contained within dashboards.

Note: This section provides an overview of the options available. For details about using Splunk tools for creating and editing dashboards, see Create and edit dashboards from Splunk Web.

Dashboard Editor

Use the Dashboard Editor to create dashboards, add panels to dashboards, edit dashboards, create forms, and generate PDFs for a dashboard.

You create a form by first creating a dashboard, then adding inputs to the dashboard. See Create and edit forms with the Dashboar Editor for details.

The Dashboard Editor includes a series of editing dialogs.

• Panel Editor
  When you enable a dashboard for editing, you can access a series of dialogs pertaining to each panel. From the Panel Editor, you edit the panel properties, access or edit the panel's underlying search, change the visualization, and configure the visualization.

• Visualization Editor
  Editing dialogs that allow you to configure the visualization. The contents of the editing dialog changes, depending on the nature of the visualization. Similar editing dialogs are available from the Splunk Search page and Report page. From Search and Report you can define visualizations that you export to a dashboard.

Access dashboards from Search, Report, or Pivot

You can create dashboards, or add panels to a dashboard, when saving a search, report, or pivot.

Pivot Editor

From Pivot you can access the Pivot Editor, a robust tool for creating and editing visualizations. Pivot Editor provides more options for defining a visualization than the Visualization Editor because it matches properties in the visualization with their definition in the pivot. For more information, See Design Pivot Charts and Visualizations with the Pivot Editor for details.

Splunk Enterprise Source Editor

For many features, you need to edit the source simple XML code. Splunk Enterprise provides a source editor that you can use to edit either simple XML or HTML.

When you edit the simple XML for a dashboard you can do the following:

• Control a much wider range of dashboard panel formatting properties. Use the custom chart configuration reference to customize the appearance of your charts and gauges.
• Create geographic maps that display location markers.
• Configure advanced, dynamic drilldown behaviors (such as drilldown clicks that take users to a second dashboard).
• Create HTML panels that display static text, images, and HTML formatting.
• Configure panels where you overlay charts. Splunk's charting library includes special chart types designed specifically for overlay purposes.

To learn how to create more sophisticated dashboards with simple XML, start with Build and edit dashboards with simple XML in this manual.

To learn how to create forms with simple XML, see Build and edit forms with simple XML in this manual.

Your favorite source code editor

You may elect to use your favorite source code editor to edit the source code for a dashboard. In addition to editing simple XML or HTML source, you may want to edit CSS or JavaScript files accessed by the dashboard.

In this scenario you need access to the Splunk instance on the host server. See About editing simple XML for more information.