Splunk® Enterprise

Dashboards and Visualizations

Splunk Enterprise versions higher than version 9.4.2 are documented on our new documentation portal only. To get started, see the Splunk Enterprise page on help.splunk.com and the Splunk Enterprise 9.4.3 release notes. For information about how version selection works in the new portal, see Version selection on the About This Site page.

Edit visualizations

Edit a visualization to configure its search, type, appearance, and behavior.


Visualization component editing

You can edit visualizations in the dashboard editor or on the Search page. In either location, you can adjust the following visualization components.

Visualization components Description
Search string Use the dashboard search editor or the search bar to change the query driving the visualization.
Type Use the Visualization Picker to select a visualization type. Ensure that the query generates results in the proper structure for the selected visualization.
Format and behavior Use the Format menu to adjust appearance, drilldown, and other settings for the visualization's user interface.

Caution: Changing visualization settings in the dashboard editor can overwrite related token settings and behavior. If you are using tokens to configure part of a dashboard or form, use caution when updating related elements in the dashboard editor. For example, if a form input configures chart legend placement, selecting a legend placement in the Format menu overwrites the dynamic token setting from the input. In this case, the input remains in the dashboard but no longer configures legend placement.


Visualization editing workflow

The workflow for editing a visualization search, type, or format is slightly different depending on whether you are editing in the dashboard editor or the Search page.

Dashboard editing permissions

Write permission is required for editing dashboard panels. By default, you have write permission for any dashboard that you create. However, you might have read-only access to other dashboards. Users with the admin role can change editing permissions.

Edit visualizations in the dashboard editor

  1. In the Search and Reporting app, select the Dashboards tab.
  2. Locate the dashboard to edit. Use one of the following options.
    Option Additional steps for this option
    Select Edit. None
    Click on the dashboard name to view it. After the dashboard opens, select Edit.
  3. In the panel you are editing, locate the icons for editing the search, visualization type, and format. Select the icon for the component you are editing.
  4. Edit the selected visualization component.

Edit visualizations on the Search page

  1. In the Search and Reporting app, select the Search tab.
  2. Enter a query.
  3. When results are available, select the Visualization tab.
  4. To edit the visualization, use one of the following tools.
    Tool Description
    Visualization Picker Change the visualization type.
    Format menu Change the visualization format and behavior. Format options vary by visualization type.
    Search bar Edit the query and rerun it to refresh the visualization.

Using the Format menu

Format menu configurations are applied immediately to visualizations.

  • Each edit that you make is saved to the visualization. You can see each change in the visualization and make adjustments as you go.
  • Edits are reflected in the dashboard Simple XML source code as they are made.
  • Click and drag the Format menu to move it anywhere on the screen.
  • Close the Format menu or click anywhere outside of it to exit and save changes.


Additional resources

Formatting and other options vary by visualization type. To compare visualizations, see the Visualization reference. See also Chart Configuration Reference.


For information on using Pivot to edit visualizations, see Design pivot charts and visualizations with the Pivot Editor.

Last modified on 01 February, 2017
Edit dashboards   Create and edit forms

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.1.7, 9.1.8, 9.1.9, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.2.4, 9.2.5, 9.2.6, 9.3.0, 9.3.1, 9.3.2, 9.3.3, 9.3.4, 9.4.0, 9.4.1, 9.4.2

Acrobat logo Download manual
Acrobat logo Download this page

Please expect delayed responses to documentation feedback while the team migrates content to a new system. We value your input and thank you for your patience as we work to provide you with an improved content experience!

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters