Splunk® Enterprise

Dashboards and Visualizations

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Add panels to dashboards

This topic discusses dashboard panels, the types of panels you can add to a dashboard, and how you can convert a panel to a different type of panel.

Panels, searches, dashboards, and forms

A dashboard contains one or more panels. Add inputs to the dashboard to create a form.

Typically, you organize multiple panels in rows. A search powers the contents of a panel, displaying the results as a table or a visualization.

The search that powers a panel can come from a variety of sources:

  • Inline search specified for that panel.
  • Inline pivot specified for that panel.
  • Search from a report
    The panel contains a reference to the report that contains the search.
  • Search from a pivot
    The panel contains a reference to a report that contains the pivot.
  • Search from a prebuilt panel
    You reference the prebuilt panel from the dashboard.

From a form or dashboard, you can use a global search that applies to all panels. Within each panel, you use a post-process search that modifies the global search and displays the results differently. Post-process searches have limitations. See Post-process searches and Post-process limitations.

Panel categories

There are three categories of panels. Depending on the panel category, you can edit the search and visualization for a panel using the Panel Editor. See Edit panels for a dashboard and Edit visualizations.

Inline panel

An inline panel contains one or more inline searches to drive the data that appears in a visualization. You create and modify the search using the Panel Editor. From the Panel Editor, select a visualization for the data and configure visualization properties.

You create inline panels three ways:

  • By saving a search or pivot as a dashboard panel. When you do this the Splunk platform creates an inline search panel by default.
  • By creating a dashboard panel that is based on an existing report. When you do this you choose to save the search as either an inline panel or a panel from a report.
  • By adding a panel to a dashboard in the Panel Editor and choosing to configure it as an inline panel. This method requires you to enter the search string into the panel definition.

Panel from a report

Create a panel based on both the search and visualization from a report.

You cannot modify the search string in the panel, but you can change and configure the visualization for the search results. If the search in the report changes, the panel based on that report updates to include the changes. Make sure you have access to the resources that the report uses.

If your permissions enable you to do so you can control whether the report is accelerated, scheduled, and embedded. You can also change the permissions of the report.

Running reports as the report owner or report user

The reports in report-backed dashboard panels can also run as the report owner or the report user. This can affect whether people with restricted data permissions can see search results in the panel.

  • A report that runs as owner runs with the permissions of the person who created the report. All users can see results in the dashboard panels backed by that report.
  • A report that runs as user runs with the permissions of the user who is viewing the dashboard. If the report contains data that the user does not have permission to see (for example, it could access an index that the user does not have access rights to), then dashboard panels backed by that report does not display results for that user.

Reports run as owner by default. Scheduled reports cannot run as user.

To set up a report to run as user, you can navigate to Settings > Searches, reports, and alerts, open the detail page for the report, and change the Run as setting. For more information, see "Create and edit reports" in the Reporting Manual.

Use scheduled reports for dashboard panels when appropriate

Back dashboard panels with scheduled reports whenever possible to reduce search processing load for your Splunk platform instance. This practice creates a "cache" for the dashboard panel so it does not have to rerun its report each time a user loads the dashboard.

For example, a dashboard panel using a historical scheduled report always displays results from the last scheduled run of the report. If a dashboard is accessed by various users 50 times over a short timespan, the dashboard panels that are not backed by scheduled reports must rerun their reports 50 times, which can be problematic from a search processing load and concurrent search limit perspective. But the panels backed by historical scheduled reports simply display the results from the last runs of their reports.

If your dashboard users want to see the most current results, back your dashboard panels with real-time scheduled reports. A real-time scheduled report runs in the background at all times. When you use it to back a dashboard panel, the panel does not launch a new instance of the real-time report each time a user loads the dashboard. Instead it displays results for the real-time scheduled report that is currently running.

You can schedule historical reports from the Search UI. To schedule a real-time report, you need to go to the Searches, Reports, and Alerts page in Settings. See "Schedule reports" in the Reporting Manual.

Prebuilt panel

Simple XML code that defines a panel that can be shared among various dashboards. To display a prebuilt panel in a dashboard, provide a reference to the prebuilt panel. You cannot edit the title, search, or visualizations of the panel from the dashboard reference.

Add panels using the Dashboard Editor

Add panels to a dashboard with the dashboard's Edit menu. Access the Edit menu directly from the dashboard or from the list of dashboards on the Dashboards page.

  1. For a dashboard, select Edit > Edit Panels.
  2. Select Add Panel.
  3. Expand one of the panel categories:
    • New
    • New from Report
    • Clone from Dashboard
    • Add Prebuilt Panel
  4. (Optional) To search for specific panels, enter text in the Filter text box.
    See Filter the search for available panels.
  5. Select a panel and preview the selection.
  6. Click Add to Dashboard.

Filter the search for available panels

Use filters in the search field to locate or create specific panels. The search looks for specified terms in existing dashboards, panels, and reports. It provides results for new panels using the specified search terms, and links to existing dashboards and panels containing the terms.

Some search tips:

  • Panel title or panel ID are useful items to search for.
  • Use visualization element names, input types, chart types, and other keywords to filter a search. For example:
    • Search for map to return results to dashboards implementing a map visualization or to create a new panel with the map visualization.
    • Search for multiselect for results with a multiselect form input.
  • You can filter for multiple items, but all items must appear in the order that you specify in the search field.

Rearrange panels on a dashboard

Drag and drop panels to rearrange their position on a dashboard.

  1. If you are not in edit mode for the dashboard, select Edit > Edit Panels.
  2. Select a panel and drag it to its new position.

Create an inline panel for a dashboard

When you create an inline panel, you select a visualization and specify a search for the panel.

  1. For a dashboard, select Edit > Edit Panels.
  2. Select Add Panel.
  3. Expand the panel category New and select a visualization for the data.
  4. (Optional) Enter a title for the panel.
  5. Enter a search string that returns the data to display in the panel.
    • (Optional) Select Run Search to preview the search results.
  6. Select a time range for the search
  7. Click Add to Dashboard.

Create a panel from a report

When you create a panel from a report, you select from a list of available reports.

  1. For a dashboard, select Edit > Edit Panels.
  2. Select Add Panel.
  3. Expand the panel category New from Report to view available reports.
    (Optional) Use the Filter option to search for specific reports. See Filter the search for available panels.
  4. Select a report to view a preview of the report.
  5. Click Add to Dashboard.

Clone a panel from another dashboard

You can clone a panel from another dashboard. The panel appears on your dashboard with the same editing capabilities as the cloned panel.

  1. For a dashboard, select Edit > Edit Panels.
  2. Select Add Panel.
  3. Expand the panel category Clone from Dashboard to view available reports.
    (Optional) Use the Filter option to search for specific panels. See Filter the search for available panels.
  4. Select and expand a dashboard. Select a panel to view a preview of the panel.
  5. Click Add to Dashboard.

Create and add a panel by reference

You can create a panel that you can later add to dashboards by reference. This prebuilt panel is useful if you plan to reuse it often in various dashboards.

There are two ways to create a panel that you can reference from other dashboards.

  • Convert an existing panel to a prebuilt panel that you can reference.
  • Create a panel in simple XML code from the Settings page.

Typically, you create the panel using the Dashboard Editor, and then convert it to a prebuilt panel. You can also create the panel in simple XML code.

Convert an existing panel to a prebuilt panel

You can convert a panel to a prebuilt panel only if the panel does not contain a post-process search. A post-process search is a search that uses the base attribute to reference another search.

  1. In the dashboard containing the panel that you want to convert, select Edit > Edit Panels.
  2. From the Options Menu for a panel, select Convert to Prebuilt Panel.
  3. (Optional) In the dialog that opens, specify the following:

    • ID: The filename for the panel. Only alphanumeric characters, '-' character, and '_' are allowed.
    • Panel Permissions: Select either Private or Shared in App.
      Private: Only you have permissions to view and edit the panel.
      Shared in App: The panel is available to view and edit by other users of the app.

Create a panel in simple XML code

If this is your first time working in simple XML code for Splunk Enterprise, see About editing simple XML. See also the entries for <panel>, Panel visualization elements and related topics in the Simple XML Reference for details on how to edit and configure panels.

  1. From Splunk Web, go to Settings > User Interface > Prebuilt Panels.
  2. In the Panels page, select New to open the Simple XML Editor.
  3. In the Simple XML Editor, specify the following:

    • Destination app: Select an app for the context of the panel.
    • Prebuilt Panel ID: Enter a name for panel.
      The name you enter is the filename on disk. Only alphanumeric characters, '-' character, and '_' are allowed.
    • Prebuilt Panel XML: Simple XML code to define a panel element.
      The simple XML code for a reference panel contains only the <panel> element and its child elements.

Add a prebuilt panel to a dashboard

  1. From the dashboard, select Edit > Edit Panels.
  2. Select Add Panel.
  3. Expand the panel category Add Prebuilt Panel to view the reference panels available.
    (Optional) Use the Filter option to search for specific panels. See Filter the search for available panels.
  4. Select a reference panel to view a preview of the panel.
  5. Click Add to Dashboard.

Convert a prebuilt panel to an inline panel

You can convert a prebuilt panel to an inline panel. The prebuilt panel cannot contain a post-process search. A post-process search is a search that uses the base attribute to reference another search.

The conversion of a prebuilt panel to an inline panel lets you customize the search and visualization.

  1. From a dashboard, select Edit > Edit Panels.
  2. From the prebuilt panel you want to convert, click the Options Menu and select Convert to Inline Panel.

Edit the title for a panel

Panels have a <title> element that is separate from the <title> element for a visualization. You can specify a title for a panel when creating a panel. You can edit titles for panels that you add to a dashboard with one exception. You cannot use the Panel Editor to edit a title to a prebuilt panel.

Note: To edit prebuilt panels, open the panel at Settings > User Interface > Prebuilt Panels.
  1. In the Panel Editor, click the title for a panel.
    You can also select the panel Options menu, and select Rename.
  2. Enter the new name of the panel.

Delete a panel from a dashboard

You can delete a panel from a dashboard using the Dashboard Editor or by editing the simple XML code.:

  • From the Dashboard Editor, in panel-editing mode, click the Options menu for a panel and select Delete.
    Or you can click the Delete icon, X, which is in the upper right corner of the panel.
  • In simple XML source code, delete the <panel> element and its contents.
PREVIOUS
About the Dashboard Editor
  NEXT
Edit dashboards with the Dashboard Editor

This documentation applies to the following versions of Splunk® Enterprise: 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters