Workflow for creating dashboards

The Splunk platform offers many options for data analysis and visualization.

Use the following workflow for creating dashboards and forms.

1. Add content
   Create the searches that power dashboards.
2. Design the user interface
   Create and modify dashboards, forms, and panels.
3. Add interactivity
   Drill down into search data.
4. Customize the dashboard
   Add customized features to your dashboard.

Add content

Searches power dashboards, forms, and data visualizations.

• Create searches to power dashboards
  For guidance on creating searches, see the Search Manual. The Search Reference provides additional information on searching, including a list of commands by category, and a complete reference to search commands.

• Searches saved as reports
  You can save a search as a report and then access the search in a dashboard by reference to the report. For more information, refer to "Create and edit reports" in the Reporting Manual.

• Generate searches with Pivot
  You can use the Pivot tool to generate searches as pivots that can be exported to reports or to dashboards. Using data models, Pivot enables you to identify data sets and to design tables, charts, and other visualizations based on the structure of the data set.

• Create panels for reuse
  You can create a single panel to use in multiple dashboards. A prebuilt panel can make complex panels available to non-technical users. When the panel implementation changes, all instances referencing the panel receive the update. See "Dashboard panels" for information on all panel types, including prebuilt panels.

For more information, see the following resources.

• Search Manual
  Get started with Search
  Write better searches

• Pivot Manual
  Pivot Manual
  Design pivot tables with the Pivot Editor

• Dashboards and Visualizations
  Anatomy of dashboards and forms
  Build dashboards in Splunk Web
  Build dashboards using simple XML

Design the user interface

There are various ways to create dashboards, including the following options.

• Create dashboards directly from the Dashboard Editor.
• Add panels to a new or existing dashboard from Search, Report, or Pivot.
• Add panels from existing dashboards.

Within the Dashboard Editor you can drag and drop panels to reposition them. Use the Visualization Editor to change panel titles, configure data visualizations, and edit searches.

For more information, see the following resources.

• Add search, report, or pivot to a dashboard
• Edit dashboards with the Dashboard Editor
• Edit visualizations
• Splunk dashboards and forms

Add interactivity

Add interactivity to dashboards with forms and drilldowns.

To learn about implementing forms and drilldowns, see the following resources.

• Splunk dashboards and forms
• Convert a dashboard to a form
• Properties available from the Visualization Editor
• Dynamic drilldown in dashboards and forms
• Drilldown element in the Simple XML Reference

Customize the dashboard

There are several ways to customize dashboards.

To learn about	See
Customizing Simple XML dashboard source code	Customize simple XML
Using CSS and JavaScript with dashboards	Customize dashboard styling and behavior in Developing Views and Apps for Splunk Web
Dashboard customization examples	Splunk Dashboard Examples app
Using the Splunk Web framework to build custom dashboards	Splunk Web Framework Overview

Adjust caching to improve UI performance

Splunk deployments with several hundred or more dashboards might have slower UI performance. To improve UI performance, increase the default max_view_cache_size setting in the web.conf configuration file. For example, for an instance with 700 dashboards, you can increase this setting to 1000. For more information, see the web.conf spec file.