Splunk® Enterprise

Dashboards and Visualizations

Acrobat logo Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Acrobat logo Download topic as PDF

Workflow for creating dashboards

The Splunk platform offers many options for data analysis and visualization.

Use the following workflow for creating dashboards and forms.

  1. Add content
    Create the searches that power dashboards.
  2. Design the user interface
    Create and modify dashboards, forms, and panels.
  3. Add interactivity
    Drill down into search data.
  4. Customize the dashboard
    Add customized features to your dashboard.

Add content

Searches power dashboards, forms, and data visualizations.

  • Searches saved as reports
    You can save a search as a report and then access the search in a dashboard by reference to the report. For more information, refer to "Create and edit reports" in the Reporting Manual.
  • Generate searches with Pivot
    You can use the Pivot tool to generate searches as pivots that can be exported to reports or to dashboards. Using data models, Pivot enables you to identify data sets and to design tables, charts, and other visualizations based on the structure of the data set.
  • Create panels for reuse
    You can create a single panel to use in multiple dashboards. A prebuilt panel can make complex panels available to non-technical users. When the panel implementation changes, all instances referencing the panel receive the update. See "Dashboard panels" for information on all panel types, including prebuilt panels.

For more information, see the following resources.

Design the user interface

There are various ways to create dashboards, including the following options.

  • Create dashboards directly from the Dashboard Editor.
  • Add panels to a new or existing dashboard from Search, Report, or Pivot.
  • Add panels from existing dashboards.

Within the Dashboard Editor you can drag and drop panels to reposition them. Use the Visualization Editor to change panel titles, configure data visualizations, and edit searches.

For more information, see the following resources.

Add interactivity

Add interactivity to dashboards with forms and drilldowns.

To learn about implementing forms and drilldowns, see the following resources.

Customize the dashboard

There are several ways to customize dashboards.

To learn about See
Customizing Simple XML dashboard source code Customize simple XML
Using CSS and JavaScript with dashboards Customize dashboard styling and behavior in Developing Views and Apps for Splunk Web
Dashboard customization examples Splunk Dashboard Examples app
Using the Splunk Web framework to build custom dashboards Splunk Web Framework Overview

Adjust caching to improve UI performance

Splunk deployments with several hundred or more dashboards might have slower UI performance. To improve UI performance, increase the default max_view_cache_size setting in the web.conf configuration file. For example, for an instance with 700 dashboards, you can increase this setting to 1000. For more information, see the web.conf spec file.

Last modified on 25 August, 2016
Dashboards and forms
Dashboard Examples App

This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters