Dashboards and forms
Every page in a Splunk app is a view. For example, the search timeline page in the Search and Reporting app is a default view. If you design your own apps you can construct views for them. You can also add views to existing apps.
Dashboards are the most common type of view. A dashboard contains one or more panels, each of which can contain visualizations such as charts, tables, event lists, and maps. Each dashboard panel uses a base search to provide results for the visualizations. Typically, the search returns results when the dashboard is loaded.
A form is a dashboard that provides user inputs to the search, such as a drop-down list, radio buttons, or a text box. A form contains the same options for panels and visualizations that are available for dashboards.
Dashboards and forms can also modify a search (post process the search) to extract and highlight different information from the search in the panels.
Anatomy of dashboards and forms
Dashboards and forms are the two types of views you can create with Simple XML. Their underlying structure is similar, but there are a few minor differences. The following Simple XML elements make up a dashboard or form. Many of these elements are optional. Refer to the Simple XML Reference for more details.
|top-level element||<dashboard> or <form>|
|Global search|| Global search is for use with post-process searches. Post-process searches have limitations. See Post-process limitations. See also
|Form inputs (Forms only)||<fieldset>|
|Rows|| Each row contains one or more panels.
|Panels|| Each panel contains an optional title, optional inputs, and one or more visualizations. See Dashboard panels for the types of panels available.
|Visualizations|| A visualization displays data returned from a search.
<chart> <event> <map> <single> <table>
|Search|| A search for a visualization. See <search> element.
<search id="[identifier]"> Base search for post-process searches.
<search base="[id]"> Post-process search referencing a base search.
<search ref="[report] [ app="[app name]" ]> Reference a search from a report. Reference to app is optional.
|Options|| Properties specific to a visualization.
<option name="[option name]">
Differences between dashboards and forms
The layout of rows, panels, and the visualizations in the panels is essentially the same. The main differences between a dashboard and a form in Simple XML are:
- Each has a different top-level element, <dashboard> and <form>.
- Forms have user inputs, such as a time range picker, drop-down lists, radio buttons, or a text box.
- The order of Simple XML elements differ slightly in the source code.
Panels typically contain a search that drives the content of a visualizations in the panel. A panel can contain the following optional elements:
One or more searches that drive the data displayed in the panel. The search can be from several sources:
- An inline search that you create and edit using the Panel Editor.
- A report that contains an imbedded search or a pivot.
- User inputs that modify the search results.
- Visualizations that display the data as graphs, tables, or charts.
- HTML encoded text to display messages to the user.
An inline panel is a panel that you can edit with the Dashboard Editor and Panel Editor. You can also edit the child elements of a panel element by editing the Simple XML source code.
You can create an inline panel in the Dashboard Editor. You can also add inline panels to dashboards from Search, Report, and Pivot. See Add panels to a dashboard for details.
A prebuilt panel is a panel that is shared on multiple dashboards. Each dashboard provides a reference to the prebuilt panel to display the panel.
You can convert a panel to a prebuilt panel. You can also create a panel that can be shared using simple XML code.
A dashboard accesses and displays a prebuilt panel with a reference attribute of the <panel> element. Use the optional <app> attribute if the prebuilt panel does not belong to the current app.
<panel ref="SharedDataPanel" app="exampleApp" />
You add a prebuilt panel in the Dashboard Editor by selecting from a list of available panels. You cannot edit a prebuilt panel with the Panel Editor.
Add panels to a dashboard
There are several ways that you can add a panel to a dashboard.
- From the Dashboard Editor, you can select the type of panel to add. Choose from the following:
- Create an inline panel.
- Add a reference to a panel.
- Add a panel from a report.
- Clone a panel from another dashboard.
- From the Search page, save the search results as an inline panel.
See Save the results in the Search Manual.
- From the detail page for a report, save the report as an inline panel.
See Create and edit reports.
- From the Pivot Editor, save the pivot as an inline panel.
In Simple XML, you can define a view as a dashboard or a form. You can also convert a Simple XML view to HTML that accesses SplunkJS Stack. After converting to HTML, a dashboard or form is no longer considered a Simple XML view.
Editors for Splunk Enterprise dashboards
There are several options for creating and editing dashboards or the visualizations contained within dashboards. This topic provides an overview of the options. For further details, see Create and edit dashboards from Splunk Web.
Use the Dashboard Editor to create dashboards, add panels to dashboards, edit dashboards, create forms, and generate PDFs for a dashboard.
Create a form by creating a dashboard and then adding inputs to the dashboard. See Create and edit forms with the Dashboard Editor for details.
The Dashboard Editor includes a series of dialogs and menus to edit the dashboard.
|Add Panel|| Add a panel to a dashboard by selecting from the following options:|
|Add Input||Add form inputs and a Submit button to a dashboard.|
|Panel Editor||Edit inline panels. From the Panel Editor, edit the panel properties, access or edit the panel's underlying search, change the visualization, or configure the visualization.|
|Visualization Editor||Configure a visualization. Configuration options vary by visualization type.|
Access dashboards from Search, Report, or Pivot
You can create dashboards or add panels to a dashboard, when saving a search, report, or pivot.
When you add a panel from the Search page, you create a panel with an inline search. You can modify the search string in the panel without affecting the original search.
When you add a panel from a report or from the Pivot Editor, you can create a panel with an inline search or link directly to the report. If you create a panel with an inline search, you can modify the search string in the panel without affecting the original report or pivot. If you link directly to the report, the contents of the panel change whenever the report changes.
From Pivot you can access the Pivot Editor, a tool for creating and editing visualizations. See Design Pivot Charts and Visualizations with the Pivot Editor for details.
Simple XML Source Editor
For many features, you need to edit the source simple XML code.
When you edit the Simple XML for a dashboard you can do the following.
- Control a wide range of dashboard panel formatting properties. See the Chart Configuration Reference for more details.
- Create maps that display location markers.
- Configure drilldown behaviors (such as drilldown clicks that take users to a second dashboard).
- Create HTML panels that display static text, images, and HTML formatting.
- Configure panels with overlay charts.
To learn how to create dashboards with Simple XML, see Build and edit dashboards with Simple XML in this manual.
To learn how to create forms with Simple XML, see Build and edit forms with Simple XML in this manual.
Other source code editors
In this scenario you need access to the Splunk instance on the host server. See About editing simple XML for more information.
Performance configuration for large numbers of dashboards
If you are working with a large number of dashboards, you may want to improve UI performance. You can adjust view caching by changing the
max_view_cache_size setting in the
web.conf configuration file. For example, if you have 700 dashboards, you can increase this setting to 1000 to improve performance.
For more information about settings in
web.conf, see the web.conf spec file in the Admin Manual.
Dashboard tools and frameworks
Workflow for creating dashboards
This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11