Splunk® Enterprise

Dashboards and Visualizations

Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Workflow for creating dashboards

Splunk is a powerful platform for the analysis and visualization of data. Splunk contains many tools for capturing this data, and then formatting the data in compelling dashboards.

Splunk recommends the following workflow for designing and creating dashboards and forms.

  1. Add content
    Create the searches that power dashboards.
  2. Design the user interface
    Create and modify dashboards, forms, and panels.
  3. Add interactivity
    Drill down into search data.
  4. Customize the dashboard
    Add customized features to your dashboard.

Add content

Splunk searches are what power dashboards, forms, and the visualizations of data contained within them. You should familiarize yourself with the tools available from Splunk to gather and analyze data.

  • Create searches to power dashboards
    Create searches to highlight the most relevant aspects of your data and support your user's goals. If you have never worked with Splunk's search language before, read the introductory sections to the Search Manual. The Search Reference provides additional information on searching with Splunk, including understanding SPL syntax, a list of commands by category, and a complete reference to Splunk platform search commands.
  • Searches saved as reports
    You can save a search as a report and then access the search in a dashboard by reference to the report. For more information, refer to the Reporting Manual. The Reporting Manual contains a section Create and edit reports that provides details.
  • Generate searches with Pivot
    You can use the Pivot tool to generate searches as pivots that can be exported to reports or to dashboards. Using data models, Pivot enables you to identify data sets and to design tables, charts, and other visualizations based on the structure of the data set. See the Pivot Manual for details.
  • Create panels for resuse
    You can create a panel that captures information that can be useful in multiple dashboards. A prebuilt panel avoids creating and updating the same panel multiple times. When there is a change in the panel implementation, all instances that reference the panel receive the updates. A prebuilt panel makes complex panels available to non-technical users. See Dashboard panels for information on all panel types, including prebuilt panels.

For more information:

Design the user interface

There are various interactive editing tools that you can use to design your dashboards. You can create dashboards directly from the Dashboard Editor. You can add panels to a new or existing dashboard from Search, Report, or Pivot. You can add panels from existing dashboards or that were created for reuse.

Within the Dashboard Editor you can drag and drop panels to reposition them within your layout. You can access the Visualization Editor dialogs to change the title of panels, configure the visualization of data, and edit the searches that power a panel.

For more information:

Add interactivity

You can create many compelling dashboards using only the Splunk Enterprise interactive tooling. However, to create forms, this release requires you to edit simple XML source code. When creating forms, use Splunk's interactive tools to design a dashboard with searches and visualizations. Then use the source editor to convert the dashboard to a form.

There are various drilldown capabilities from visualizations. The default drilldown behavior is configurable from the Visualization Editor. You can use dynamic drilldown to specify linking to other views or external web pages. With dynamic drilldown, you can send parameters to forms or third party web pages to drive the content of the destination. To implement dynamic drilldown, edit the source code of a dashboard or form.

For more information:

Customize the dashboard

There are several extension points to simple XML that you can use to modify the layout, add new visualizations, and customize behavior of dashboards. With these customizations, you can create compelling views for your content.

Implement these customizations using various combinations of custom stylesheets, JavaScript, and simple XML code.

  • CSS styles
    Add custom stylesheets for individual dashboards in an app.
  • Layout
    Make simple layout changes, such as rearranging dashboard and form elements and hiding panels.
  • Tokens
    Set custom tokens throughout the dashboard page.
  • Custom visualizations
    Build custom visualizations as dashboard panels.
  • Table cell renderers
    Specify custom styles and behavior within table cells.

For more information:

Last modified on 08 December, 2015
Dashboards and forms
Dashboard Examples App

This documentation applies to the following versions of Splunk® Enterprise: 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters