Splunk® Enterprise

Dashboards and Visualizations

Acrobat logo Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Acrobat logo Download topic as PDF

About the Dashboard Editor

You can use the Dashboard Editor to create and edit dashboards without writing a single line of XML code. From the Dashboard Editor you can do the following:

  • Create dashboards
  • Add panels to dashboards
  • Add form inputs to convert the dashboard to a form
  • Rearrange dashboard panels using a drag-and-drop interface.
  • Edit the searches that drive data in the dashboard.
  • Specify different visualizations for a panel.
  • Specify formatting options for a panel visualization.
  • Edit the source code for a dashboard.
  • Convert a dashboard to HTML.

Open the Dashboard Editor

To create a new dashboard:

  1. From the Dashboards page of an app, click Create New Dashboard.
    You create dashboards from the context of an app. After you create a dashboard, you can modify the permissions to specify who has access to the dashboard. You can also move the dashboard to another app context.
  2. Provide a Title, ID, and Description. Specify permissions. Then click Create Dashboard.
  3. Add panels, add an input, or edit the source code for the dashboard to proceed.
    See Add panels to dashboards and Create and edit forms with the Dashboard Editor.
  4. Click Done to create the dashboard.

To edit an existing dashboard:

  1. From the Dashboards page of an app, click an existing dashboard.
  2. Click Edit to view the options to edit the dashboard.
    Refer to Edit dashboards with the Dashboard Editor for details on editing dashboards.

Add a search, report, or pivot to a dashboard

You can add a search, report, or pivot as a panel to a new or existing dashboard.

Panel type How to add this panel type to a dashboard
Search or Pivot Click Save As > Dashboard Panel.
Report Click Add to Dashboard.

Panel options vary depending on the panel type and whether you are adding the panel to an existing dashboard or creating a new one.

Panel search permissions
The search that drives a dashboard panel can run using the permissions of the user who created the search (the search owner), or a user who views the dashboard (a search user).

Depending on the results data access that you want to provide, you can adjust the permissions context for the search in the Reports listing page. Locate the search on this page and select Edit > Edit Permissions to change whether the search runs with the owner or user context.

Specify visualizations for the dashboard panel

When you run a new search or open a report, the visualizations recommended to you depend on the results of the search. If the search does not include transforming commands, only the events list is available. If you run the search in Verbose Mode, you can view a listing of events for the search, even if the search is a reporting search.

When you add the search to a dashboard panel, you select how the panel displays the results. You can later change your selection from the Dashboard Panel Editor.

For more information, see Edit dashboards with the Dashboard Editor.

Specify dashboard permissions

When creating a dashboard, you specify the following permissions for the dashboard from the Create Dashboard Panel:

  • Private
    Only you have permissions to view and edit the dashboard.
  • Shared in App
    The dashboard is available to other users from the app in which you created the dashboard. Other users can view the dashboard, and depending on their permissions, edit the dashboard.

After creating a dashboard you can change the permissions.

  1. From the Dashboards page, locate the dashboard for which you want to edit permissions.
  2. Under Actions, select Edit > Edit Permissions
  3. Specify the following:

    • Display for Owner, App, or All Apps
    • Read and write privileges for users
      Your user role, and capabilities defined for that role, can limit the type of access you can define.

More about dashboard permissions

A dashboard is a knowledge object in Splunk Enterprise and you manage its permissions accordingly. Your user role (and capabilities defined for that role) may limit the type of access you can define.

For example, if your user role is "user" with the default set of capabilities, then you can only create dashboards that are private to you. You can, however, provide read and write access to other users.

If your user role is "admin" with the default set of capabilities, then you can create dashboards that are private, visible in a specific app, or visible in all apps. You can also provide access to other Splunk user roles.

For additional information on setting up permissions for dashboards and other knowledge objects see Manage knowledge object permissions in the Knowledge Manger manual.

Edit permissions example

The following example shows how an admin user can set permissions for a dashboard.

Note: For other user roles, such as "user," the choices for permissions in the Dashboard Editor are a subset of the choices available to the admin user.
  1. For a dashboard, select Edit then select Edit permissions
  2. Specify permissions for the dashboard and click Save. Choose from the following:

    • Owner: The dashboard is only visible to the user who created it.
    • App: Dashboards can be visible only for the app in which it was created. Specify the read and write permissions for user roles.
    • All apps: The dashboard is visible from all apps. Specify the read and write permissions for user roles.

Convert a dashboard to a form

The underlying simple XML for a form differs slightly from the simple XML for a dashboard. There are two ways to convert a dashboard to a form:

  • Add a time picker or a form input to a dashboard.
    The underlying simple XML updates to convert the dashboard to a form.
  • Edit the source simple XML for a dashboard to include form elements.

Customize a dashboard

There are several options to customize a dashboard, adding features not available from the Dashboard Editor.

  • Edit the underlying simple XML to implement advanced features.
    Typically, you edit the simple XML to edit visualization features that are not available from the interactive editors. You can also take advantage of tokens from search strings to customize the appearance of text. See About editing simple XML and Token usage in dashboards.
  • Convert or export the dashboard as HTML.
    After converting the dashboard, edit the HTML code, JavaScript, and style sheets to specify custom behavior. See Convert a dashboard to HTML.
Last modified on 02 June, 2016
Dashboard Examples App
Add panels to dashboards

This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters