Splunk® Enterprise

Dashboards and Visualizations

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Dashboards and forms

Every page in a Splunk Enterprise app is a view. For example, the search timeline page in the Search and Reporting app is a default view that ships with that app. If you design your own apps you can construct views for them. You can also add views to existing apps.

Dashboards are the most common types of views. Each dashboard contains one or more panels, each of which can contain visualizations such as charts, tables, event lists, and maps. Each dashboard panel uses a base search to provide results for the visualizations. Typically, the search returns results when the dashboard is loaded.

A form is a dashboard that provides user inputs to the search, such as a drop-down list, radio buttons, or a text box. A form contains the same options for panels and visualizations that are available for dashboards.

Dashboards and forms can also modify a search (post process the search) to extract and highlight different information from the search in the panels.

Anatomy of dashboards and forms

Dashboards and forms are the two type of views you can create with simple XML. Their underlying structure is the same, except for a few minor differences. The following simple XML elements make up a dashboard or form. Many of these elements are optional. Refer to the Simple XML Reference for a detailed description of the underlying simple XML.


Element Description
top-level element <dashboard> or <form>
Title <label> (Optional)
Description <description> (Optional)
Global search Global search is for use with post-process searches. Post-process searches have limitations. See Post-process limitations. See <search> element.

<search id="[identifier]">

Form inputs (Forms only) <fieldset>
  <input>
    <text>
    
Rows Each row contains one or more panels.

<row>

Panels Each panel contains an optional title, optional inputs, and one or more visualizations. See Dashboard panels for the types of panels available.

<panel>

Visualizations A visualization displays data returned from a search.

<chart> <event> <map> <single> <table>

Search A search for a visualization. See <search> element.

<search>

<search id="[identifier]"> Base search for post-process searches.

<search base="[id]"> Post-process search referencing a base search.

<search ref="[report] [ app="[app name]" ]> Reference a search from a report. Reference to app is optional.

Options Properties specific to a visualization.

<option name="[option name]">

Differences between dashboards and forms

The layout of rows, panels, and the visualizations in the panels is essentially the same. The main differences between a dashboard and a form in simple XML are:

  • Each has a different top-level element, <dashboard> and <form>.
  • Forms have user inputs, such as a time range picker, drop-down lists, radio buttons, or a text box.
  • The order of simple XML elements differ slightly in the source code.

For details on the underlying simple XML, see the Simple XML Reference. Compare the entries for <dashboard> and <form>.

Dashboard panels

Panels typically contain a search that drives the content of a visualizations in the panel. A panel can contain the following optional elements:

  • Title
  • Search
    One or more searches that drive the data displayed in the panel. The search can be from several sources:
    • An inline search that you create and edit using the Panel Editor.
    • A report that contains an imbedded search or a pivot.
  • User inputs that modify the search results.
  • Visualizations that display the data as graphs, tables, or charts.
  • HTML encoded text to display messages to the user.

Inline panel

An inline panel is a panel that you can edit with the Dashboard Editor and Panel Editor. You can also edit the child elements of a panel element by editing the simple XML source code.

You can create an inline panel in the Dashboard Editor. You can also add inline panels to dashboards from Search, Report, and Pivot. See Add panels to a dashboard for details.

Prebuilt panel

A prebuilt panel is a panel that is shared on multiple dashboards. Each dashboard provides a reference to the prebuilt panel to display the panel.

You can convert a panel to a prebuilt panel. You can also create a panel that can be shared using simple XML code.

A dashboard accesses and displays a prebuilt panel with a reference attribute of the <panel> element. Use the optional <app> attribute if the prebuilt panel does not belong to the current app.

<panel ref="SharedDataPanel" app="exampleApp" />

You add a prebuilt panel in the Dashboard Editor by selecting from a list of available panels. You cannot edit a prebuilt panel with the Panel Editor.

See Create and add a panel by reference.

Add panels to a dashboard

There are several ways that you can add a panel to a dashboard.

  • From the Dashboard Editor, you can select the type of panel to add. Choose from the following:
    • Create an inline panel.
    • Add a reference to a panel.
    • Add a panel from a report.
    • Clone a panel from another dashboard.
  • From the Search page, save the search results as an inline panel.
    See Save the results in the Search Manual.
  • From the Pivot Editor, save the pivot as an inline panel.

About views

In simple XML, you can define a view as a dashboard or a form. However, there are other types of views in the Splunk Web Framework.

  • Advanced XML views
    Dashboards created in legacy advanced XML define views according to imported Mako templates. Additional views besides dashboards and forms are available including views from custom Mako templates. For more information, see Layout templates for advanced XML.
  • HTML plus SplunkJS Stack
    You can convert a simple XML view to HTML that accesses SplunkJS Stack. After the conversion, the concept of a dashboard or form view, as defined in simple XML, no longer applies.

Editors for Splunk Enterprise dashboards

Splunk Enterprise provides options for creating and editing dashboards, and also the visualizations contained within dashboards. This topic provides an overview of the options available. For details about using Splunk Enterprise tools for creating and editing dashboards, see Create and edit dashboards from Splunk Web.

Dashboard Editor

Use the Dashboard Editor to create dashboards, add panels to dashboards, edit dashboards, create forms, and generate PDFs for a dashboard.

You create a form by creating a dashboard and then adding inputs to the dashboard. See Create and edit forms with the Dashboard Editor for details.

The Dashboard Editor includes a series of dialogs and menus to edit the dashboard.

Editor Description
Add Panel Add a panel to a dashboard by selecting from the following options:

  • Create a new inline panel.
  • Add a panel that is based on a report.
  • Add a reference to a prebuilt panel.
  • Clone a panel from another dashboard.
Add Input Add form inputs and a Submit button to a dashboard.
Panel Editor A series of dialogs to edit inline panels. From the Panel Editor, you edit the panel properties, access or edit the panel's underlying search, change the visualization, and configure the visualization.
Visualization Editor A series of dialogs to configure a visualization. The dialogs available change, depending on the nature of the visualization. Similar editing dialogs are available from the Search page and Report page. From Search and Report you can define visualizations that you export to a dashboard.

Access dashboards from Search, Report, or Pivot

You can create dashboards, or add panels to a dashboard, when saving a search, report, or pivot.

When you add a panel from the Search page, you create a panel with an inline search. You can modify the search string in the panel without affecting the original search.

When you add a panel from a report or from the Pivot Editor, you can create a panel with an inline search or link directly to the report. If you create a panel with an inline search, you can modify the search string in the panel without affecting the original report or pivot. If you link directly to the report, the contents of the panel change whenever the report changes.

Pivot Editor

From Pivot you can access the Pivot Editor, a tool for creating and editing visualizations. Pivot Editor provides more options for defining a visualization than the Visualization Editor because it matches properties in the visualization with their definition in the pivot. See Design Pivot Charts and Visualizations with the Pivot Editor for details.

Splunk Enterprise Source Editor

For many features, you need to edit the source simple XML code. Splunk Enterprise provides a source editor that you can use to edit either simple XML or HTML.

When you edit the simple XML for a dashboard you can do the following:

  • Control a wide range of dashboard panel formatting properties. Use the Chart Configuration Reference to customize the appearance of charts and gauges.
  • Create geographic maps that display location markers.
  • Configure advanced, dynamic drilldown behaviors (such as drilldown clicks that take users to a second dashboard).
  • Create HTML panels that display static text, images, and HTML formatting.
  • Configure panels with overlay charts. The Splunk Enterprise charting library includes special chart types for overlay purposes.


To learn how to create more sophisticated dashboards with simple XML, see Build and edit dashboards with simple XML in this manual.

To learn how to create forms with simple XML, see Build and edit forms with simple XML in this manual.

Source code editor

You can use your favorite source code editor to edit the source code for a dashboard. In addition to editing simple XML or HTML source, you can edit CSS or JavaScript files accessed by the dashboard.

In this scenario you need access to the Splunk instance on the host server. See About editing simple XML for more information.

PREVIOUS
Splunk Web Framework
  NEXT
Workflow for creating dashboards

This documentation applies to the following versions of Splunk® Enterprise: 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters