Splunk® Enterprise

Dashboards and Visualizations

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Edit dashboards with the Dashboard Editor

This topic shows the basic editing operations from the Dashboard Editor that apply to a dashboard or a form. The Edit Visualizations topic describes how to create and modify visualizations for dashboard panels.

Other than Convert a dashboard to a form, the subtopics apply equally to dashboards and forms.

Convert a dashboard to a form

The following procedure shows how to convert a dashboard to a form. Adding inputs to a dashboard converts the dashboard to a form.

To create a form from a dashboard:

  1. Create a dashboard with one or more panels.
  2. If you are not in edit mode, select Edit > Edit Panels.
  3. From the Add Input menu, select one or more inputs.
  4. For each input added, edit the input to specify the input behavior.
  5. (Optional) Drag and drop the inputs to rearrange them in the newly created form.
  6. (Optional) Drag an input into a panel to specify an input applicable only to that panel.

For details on creating and editing forms, see Create and edit forms with the Dashboard Editor.

Edit panels for a dashboard

The tools available to edit a panel depend on the base search that powers the panel. The Panel Editor displays an icon for each type of base search:

Icon Search
InlineSearchIcon.png Inline search
InlinePivotIcon.png Inline pivot
SearchReportIcon.png Search from report.
PivotReportIcon.png Pivot from report

To edit the search that powers a dashboard panel:

  1. If you are not in edit mode for the dashboard, select Edit > Edit Panels.
    Each panel displays three editing icons for modifying the contents of the panel.
  2. Select the Panel Properties icon.
    The options available to you depend on the type of base search.
All panel types
  • Edit the title for the panel.
  • Delete the panel.
Reports
  • View the report.
  • Open the search in Search or Pivot.
  • Clone to an inline search or pivot.
  • Select a different report for the panel.
  • Select the visualization specified in the report for this panel.
Inline searches and inline pivots
  • Edit the search specifying the inline search or inline pivot.
  • Convert the inline search or pivot to a report.
For more information on searches, reports, and pivots refer to:

To change the visualization for a panel:

  1. If you are not in edit mode for the dashboard, select Edit > Edit Panels.
  2. Click the Visualization icon, and select a visualization. The graphic for the Visualization icon reflects the type of visualization currently selected.

    Splunk Web lists visualizations available, noting which ones are recommended for the search.

    If the search is a pivot or a pivot report, you cannot change the visualization for the panel. Instead, use the Pivot Editor to modify the visualization. See Design pivot charts and visualizations with the Pivot Editor for details.

To configure the visualization for a panel:

  1. If you are not in edit mode for the dashboard, select Edit > Edit Panels.
  2. Click the Visualization Formatting icon.
    The properties available to configure depend on the visualization selected.
  3. Configure the visualization.
    See Properties available from the Visualization Editor for details on formatting visualizations.

View, export, and inspect a search for a visualization

In the Panel Editor you can access and view details of the search that drives the data in a panel. You can do the following:

  • Open the search in the Search app.
  • Open the pivot in the Pivot Editor.
  • Export the results of the search in several formats.
  • View the search in the Search Job Inspector.
  • Refresh the search.

These features are available from icons that are visible when you mouse-over a panel.

Viz export search.png

You can disable these features by editing the simple XML for a visualization. See Disable search access features for a visualization.

View a search for a visualization in the Search app

You can open a search for a visualization in the Search app. This is useful to inspect details of the search and perhaps test modifications to it before updating the search in the panel.

If the visualization uses a pivot instead of a search, you open the pivot in Pivot Editor. The procedure shows a visualization based on a search.

To view a search or pivot for a visualization:

  • In the Panel Editor, click the Open in Search icon.
    A new window opens with the search running in the Search app.

Export the results of the search in different formats

You can save the results of the search, or a limited set of results, to a file.

To export search results for a panel:

  1. In the Panel Editor, click the Export icon.
  2. In the Exports Results dialog specify the following:

    • Format: CVS, JSON, XML, or PDF.
      PDF is only available for searches from reports.
    • Filename: (Optional) A name for the file to save the results.
    • Number of results: Select Limited or Unlimited.
  3. Click Export to save the results on your local file system.

Open the search in the Search Job Inspector

Use the Search Job Inspector to view details of the search. See View search job properties in the Search Manual.

To view details for a search for a visualization:

  • In the Panel Editor, click the Inspect icon.
    The Search Job Inspector opens in a new window.

Refresh the search

You can refresh the results for a search in a panel. This is useful to verify that you are seeing the latest results.

To refresh a search for a panel:

  • In the Panel Editor, click the Refresh icon.

Disable search access features for a visualization

You can disable search access features for a visualization by editing the simple XML source code for the visualization. Each visualization contains the following properties that enable these features. See the property details for each Panel visualization element in the Simple XML Reference.

Property Type Default Description
link.exportResults.visible Boolean
(See description)
Show the Export button at the bottom of the panel.

Default value: The value of link.visible.

link.inspectSearch.visible Boolean
(See description)
Show the Inspect button at the bottom of the panel.

Default value: The value of link.visible.

link.openPivot.visible Boolean
(See description)
Show the open in Pivot button at the bottom of the panel.

Default value: The value of link.visible.

link.openSearch.search search string
The alternative search to use for the Open in Search button.
link.openSearch.visible Boolean
(See description)
Show the Open in Search button at the bottom of the panel.

Default value: The value of link.visible

link.visible Boolean
true
Show link buttons at the bottom of the panel.

The following code snippet sets the link.visible property to false to disable all the search access icons at the bottom of a panel with a chart visualization:

<panel>
  <chart>
    <title>Top sourcetypes in the last 24 hours</title>
    <search>
      <query>
        index=_internal group=per_sourcetype_thruput 
        | chart sum(kb) by series 
        | sort -sum(kb)</query>
      <earliest>-1d</earliest>
      <latest>now</latest>
    </search>
    <option name="charting.axisY.scale">log</option>
    <option name="link.visible">false</option>
  </chart>
</panel>

Dashboard editing operations

There are various editing operations that apply to an entire dashboard.

Edit the source code for a dashboard

You can also access and edit the source code for a dashboard and the panels it contains. For dashboards based on simple XML, edit the source code to access features not available from the Dashboard Editor. For dashboards based on HTML, this is the only way you can edit the dashboard without using a third party editor.

To edit the source code for a dashboard:

  1. From a dashboard, select Edit > Edit Source.
    Splunk lists the type of a dashboard when listing the editing options.

For information about editing simple XML source code see the chapter Building dashboards using simple XML.

For information about editing dashboards converted or exported to HTML, see convert a dashboard to HTML.

Convert a simple XML dashboard to HTML

By default, dashboards are based on simple XML code. You can convert or export a dashboard so it is based on HTML that accesses SplunkJS Stack.

Note: You cannot use Splunk visual editors to edit HTML dashboards. Integrated PDF generation is not available for HTML dashboards.

To convert the source code for a dashboard to HTML:

  1. From a dashboard, select Edit > Convert to HTML.
  2. Specify the following, then click Convert Dashboard:
  • Select Create New or Replace Current
    If you replace the current dashboard, the underlying simple XML is no longer available. To preserve the original code, create a new dashboard.
  • Title
  • ID
  • Description
  • Permissions
    After converting the dashboard, you have an opportunity to further edit the permissions.

For more information about converting simple XML source code to HTML and then editing the exported HTML, see convert a dashboard to HTML.

Clone a dashboard

You can clone a dashboard to create a copy of it based on the existing dashboard. The procedure to clone a dashboard is available from the Edit menu for a dashboard. You can access the Edit menu directly from the dashboard or from the list of dashboards on the Dashboards page.

To clone a dashboard:

  1. For the dashboard you want to clone, select Edit > Clone.
  2. Provide a new Title, ID, and Description. Click Clone Dashboard.
  3. After Splunk clones the dashboard, you have the following options:
  • View and set permissions for the dashboard.
  • Schedule PDF delivery for the dashboard.
  • Edit Panels to open the dashboard in edit mode.
  • View to view the copy of the dashboard.

Delete a dashboard

The procedure to delete a dashboard is available from the Edit menu for a dashboard. You can access the Edit menu directly from the dashboard or from the list of dashboards on the Dashboards page.

To delete a dashboard:

  1. For the dashboard you want to delete, select Edit > Delete.
  2. Confirm that you want to delete the dashboard and click Delete.

Schedule PDF delivery of a dashboard

You can schedule PDF delivery for a dashboard from the Edit menu for a dashboard. You can access the Edit menu directly from the dashboard or from the list of dashboards on the Dashboards page.

Note: PDF delivery is only available for dashboards based on simple XML. You cannot schedule PDF delivery for dashboards converted or exported to HTML.

To schedule PDF delivery of a dashboard:

  1. For the dashboard you want to schedule, select Edit > Schedule PDF Delivery.
  2. Toggle the Schedule PDF Delivery check box to enable or disable PDF delivery.
  3. If you enable PDF delivery, you can specify the following options:

    Schedule
    Email addresses for delivery
    Subject line for email delivery ($name$ specifies the Title of the dashboard.)
    Paper Size
    Paper Layout
  4. (Optional) You can send a test email or view a sample PDF before scheduling delivery.
  5. Click Save to save your PDF delivery settings.

For more information, see Generate dashboard PDFs.

Dashboard editing operations on the app level

Various dashboard editing operations apply to a dashboard with respect to its app context.

Change the app context for a dashboard

You create dashboards within the context of an app. Unless you set global permissions for the dashboard, it is not available from other apps. However, you can change the app context for a dashboard. This is essentially moving the dashboard from one app to another.

Note: Your ability to perform this operation depends on your user role and capabilities.

To change the app context for a dashboard:

  1. From Splunk Web, select Settings > User interface > Views.
  2. Locate the dashboard you want to move, and for Actions, select Move.
  3. Select an app context. Click Move.

Specify navigation for an app

You can add a dashboard to the navigation bar for an app, create a group of dashboards as a dropdown list from the navigation bar, and specify a default view for an app. To perform this procedure, edit the navigation menu XML from the Splunk Settings menu. You must have the appropriate user role and capabilities to access this feature.

Note: Navigation is managed on an app by app basis. If your dashboard has been promoted globally to all of the apps in your system, it initially appears in the default drop-down list for "unclassified" views in those apps' top-level navigation menus. Users with write permissions for those apps can move the dashboard to its proper location in the app navigation menus as appropriate.

To access the navigation menu XML for an app:

  1. From any Splunk view, select Settings > User interface > Navigation menus.
  2. Select the app from App context.
  3. If necessary, select the user role from Owner.
    The user roles depend on the permission configuration for the app.
  4. Under Nav name, select default to open the navigation menu XML in the Splunk Source editor.
    Edit the navigation menu XML, as described below.

Add a dashboard to the navigation bar

You can add a dashboard to the navigation bar by listing it with the <view> element as a child of the <nav> element. The following example shows how to add a dashboard (my_dashboard) to the default views of an app's navigation bar.

<nav search_view="search" color="#993300">
  <view name="search" default='true' />
  <view name="data_models" />
  <view name="reports" />
  <view name="alerts" />
  <view name="dashboards" />
  <view name="my_dashboard"/>
</nav>

The name attribute to the <view> element specifies the ID of the dashboard. When you create a dashboard, you specify this ID. The dashboard ID specifies the leaf node of the URL that accesses the dashboard.

Use the <collection> element to create a dropdown list of dashboards to the navigation bar.

 <view name="search" default="true"/>
 <view name="data_models" />
 <view name="reports" />
 <view name="alerts" />
 <view name="dashboards"/>
 <collection label="Shadow Dashboards">
   <view name="my_dashboard"/>
   <view name="my_other_dashboard"/>
 </collection>

</nav>

Specify a default view for an app

You define the default view for an app with the default attribute to the <view> element. A view so designated becomes the home view for the app. By default, the Search view is the home view of an app.

For example, to specify the Reports view as the home view:

  <view name="reports" default="true"/>

To specify a default view for drilldown: You define the default view for drilldown behavior in an ap with the search_view attribute to the <nav> element. This becomes the home view for the app. For drilldown behavior, dashboards in the app link to the specified view unless you customize drilldown behavior for a panel.

Note: Typically, users expect the Search view for drilldown behavior. Be careful before changing this default behavior.

Specify a color for the navigation bar for an app

Use the color attribute for the <nav> element to specify the color of an app's navigation bar. For example:

  <nav search_view="search" color="#993300">
PREVIOUS
Add panels to dashboards
  NEXT
Create and edit forms with the Dashboard Editor

This documentation applies to the following versions of Splunk® Enterprise: 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters