
Workflow for creating dashboards
The Splunk platform offers many options for data analysis and visualization.
Use the following workflow for creating dashboards and forms.
- Add content
Create the searches that power dashboards. - Design the user interface
Create and modify dashboards, forms, and panels. - Add interactivity
Drill down into search data. - Customize the dashboard
Add customized features to your dashboard.
- Add content
Add content
Searches power dashboards, forms, and data visualizations.
- Create searches to power dashboards
For guidance on creating searches, see the Search Manual. The Search Reference provides additional information on searching, including a list of commands by category, and a complete reference to search commands.
- Searches saved as reports
You can save a search as a report and then access the search in a dashboard by reference to the report. For more information, refer to "Create and edit reports" in the Reporting Manual.
- Generate searches with Pivot
You can use the Pivot tool to generate searches as pivots that can be exported to reports or to dashboards. Using data models, Pivot enables you to identify data sets and to design tables, charts, and other visualizations based on the structure of the data set.
- Create panels for reuse
You can create a single panel to use in multiple dashboards. A prebuilt panel can make complex panels available to non-technical users. When the panel implementation changes, all instances referencing the panel receive the update. See "Dashboard panels" for information on all panel types, including prebuilt panels.
For more information, see the following resources.
- Search Manual
Get started with Search
Write better searches
- Dashboards and Visualizations
Anatomy of dashboards and forms
Build dashboards in Splunk Web
Build dashboards using simple XML
Design the user interface
There are various ways to create dashboards, including the following options.
- Create dashboards directly from the Dashboard Editor.
- Add panels to a new or existing dashboard from Search, Report, or Pivot.
- Add panels from existing dashboards.
Within the Dashboard Editor you can drag and drop panels to reposition them. Use the Visualization Editor to change panel titles, configure data visualizations, and edit searches.
For more information, see the following resources.
- Add search, report, or pivot to a dashboard
- Edit dashboards with the Dashboard Editor
- Edit visualizations
- Splunk dashboards and forms
Add interactivity
Add interactivity to dashboards with forms and drilldowns.
To learn about implementing forms and drilldowns, see the following resources.
- Splunk dashboards and forms
- Convert a dashboard to a form
- Properties available from the Visualization Editor
- Dynamic drilldown in dashboards and forms
- Drilldown element in the Simple XML Reference
Customize the dashboard
There are several ways to customize dashboards.
To learn about | See |
---|---|
Customizing Simple XML dashboard source code | Customize simple XML |
Using CSS and JavaScript with dashboards | Customize dashboard styling and behavior in Developing Views and Apps for Splunk Web |
Dashboard customization examples | Splunk Dashboard Examples app |
Using the Splunk Web framework to build custom dashboards | Splunk Web Framework Overview |
Adjust caching to improve UI performance
Splunk deployments with several hundred or more dashboards might have slower UI performance. To improve UI performance, increase the default max_view_cache_size
setting in the web.conf
configuration file. For example, for an instance with 700 dashboards, you can increase this setting to 1000. For more information, see the web.conf spec file.
PREVIOUS Dashboards and forms |
NEXT Dashboard Examples App |
This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11
Feedback submitted, thanks!