Splunk® Enterprise

Search Tutorial

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Create dashboards and panels

In this section, you will save a search as a dashboard panel and add an input element to the dashboard.

Save a search as a dashboard panel

  1. Start a new search.
  2. Run the following search.

    sourcetype=access_* status=200 action=purchase | top categoryId

    This screen image shows the results of the search on the Statistics tab.  The three columns displayed in the results are category ID, count, and percent. The category ID column displays the type of game or product, such as STRATEGY, SIMULATION, and TEE (for t-shirts).
  3. Click the Visualization tab. The displays shows a Line Chart.
  4. Change the Line Chart to Pie Chart.
    This screen image shows the Visualizations tab. The chart has been changed to a Pie chart. The STRATEGY piece of the Pie chart is the largest piece.
  5. Click Save As and select Dashboard Panel.
    This screen image shows the Save As drop-down list. The second option on the list is Dashboard Panel.
  6. Define a new dashboard and dashboard panel.
    1. For Dashboard, click New.
    2. For Dashboard Title, type Buttercup Games - Purchases.
    3. The Dashboard ID field displays buttercup_games__purchases"'.
    4. For Dashboard Description, type Reports on Buttercup Games purchases data
    5. For Dashboard Permissions, keep the default setting Private.
    6. For Panel Title, type Top Purchases by Category.
    7. For Panel Powered By, keep the default setting Inline search.
    8. For Panel Content, keep the setting for Pie Chart.
    This screen image shows the Save As Dashboard Panel dialog box.  All of the fields are filled in as described in the following steps.
  7. Click Save.
    This screen image shows a confirmation dialog box. In the dialog box there is a button called View Dashboard.
  8. Click View Dashboard.
    This screen image shows the new dashboard "Buttercup Games - Purchases". There is one panel entitled Top Purchases by Category, which shows the Pie chart
    You now have a dashboard with one report panel. To add more report panels, you can either run new searches and save them to this dashboard, or you can add saved reports to this dashboard. You will add more panels to this dashboard in the next section.

For now, let's spend a little bit more time on this dashboard panel.

View and edit dashboard panels

There is a separate view to see a list of the dashboards that you have access to. From this view, you can create dashboards, and make changes to dashboards and dashboard panels.

  1. Click Dashboards in the App bar to see the Dashboards view.

  2. You might see a pop-up dialog box asking if you want to take a tour about dashboards. If you take the tour, there is an option at the end of the tour to try dashboards yourself. This option displays the Dashboards view.

    This screen image shows the Dashboards view. There are two dashboards listed.  One is the Buttercup Games - Purchases dashboard that you created. The other dashboard displays orphaned scheduled searches, reports, and alerts. There are six columns in the view. The first column is the information column. The second column displays the Title of the dashboards. The third column is the Actions column and contains an "Edit" drop down. The remaining columns are "Owner", "App", and "Sharing".
  3. For the Buttercup Games - Purchases dashboard, click the arrow ( > ) symbol in the i column to expand the dashboard information.
    You can see information about the app that this dashboard is associated with, whether or not the dashboard is scheduled, and dashboard permissions.
  4. This screen image shows the expanded information for the Buttercup Games - Purchases dashboard.

    Add controls to a dashboard

    You can add input controls, such as the Time range picker, to dashboard panels.

    1. In the Dashboards list, click Buttercup Games - Purchases to display that dashboard.

    This screen image shows the Buttercup Games - Purchases dashboard, with the Edit drop-down opened.

    2. Click Edit, and select Edit Panels.

    The title changes to Edit: Buttercup Games - Purchases to alert you that the panel is in the edit mode.
    Several edit buttons appear on the upper right corner of the view. The buttons are Add Input, Add Panel, and Edit Source.
    This screen image shows the Buttercup Games - Purchases dashboard, with a red box around the Edit buttons.

    3. Click Add Input, and select Time.

    This screen image shows the options on the Add Input drop-down list.
    The Time range picker input control appears on the dashboard.
    This screen image shows the Time range picker control added to the upper-left corner of the dashboard. There are two icons above the control. The pencil is the Edit Input icon. The X is the Delete Input icon

    4. Click the Edit Input icon for the Time range picker. The icon looks like a pencil.

    This opens a set of input controls. The Time input type is selected.
    This screen image shows the options for the time range picker control.  The options include adding a label to the control and specifying a default time range.
    a. For Label, type Time range
    b. For Token, type BG_Purchases_Time_Range
    The controls that you add to a dashboard have identifiers called input tokens. This step redefines the name of the input token for the Time range picker. The default names for input tokens are field1, field2, field3, and so on. You can change the input tokens when you add controls to your dashboard. Naming the tokens makes it easier to understand which input you are working with. In this example you used a token name that includes the a short version of the dashboard title.
    c. For Default, change the default time range to Previous week.
    d. Click Apply.
    The input controls that you add to a dashboard are independent from the dashboard panels. If you want the chart on the panel to refresh when you change the time range, you need to connect the dashboard panel to the Time range picker input control.

    5. In the dashboard panel, click the Inline Search icon, which looks like a magnifying glass.

    6. Click Edit Search String.

    This screen image shows the Edit Search dialog box.

    7. In the Edit Search dialog box, for Time Range Scope select Shared Time Picker (BG_Purchases_Time_Range).

    This screen image shows the Edit Search dialog box with the Shared Time Picker selected.

    8. Click Save.

    The panel is now connected to the Time range picker input control in the dashboard. This Time range picker is referred to as the shared Time range picker. The inline search that powers the panel now uses the time range that is specified in the shared Time range picker.

    You can have dashboards that contain a mix of panels. Panels that are connected to the shared Time range picker, and panels that show data for the time range specified in the search that the panel is based on. You will learn more about connecting other panels to the shared time picker in the next section.

    9. In the upper right corner of the view, click Done to save your changes to the dashboard.

    This screen image shows the updated Buttercup Games - Purchases dashboard.

    Next step

    Learn about adding more panels to a dashboard.

    See also

    About the Dashboard Editor in Dashboards and Visualizations
PREVIOUS
About dashboards
  NEXT
Add more panels to dashboards

This documentation applies to the following versions of Splunk® Enterprise: 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11


Comments

it is very well hidden. to be clear, you have to hit the magnifying glass in the upper right, then "edit search string." Would be nice to have it similar to the report UI

Johnoke
September 22, 2016

Never mind. Found it hidden under the Edit Panels. Not really intuitive there, but I'll get used to it. I use vi. I can get used to anything.

Chrisknox
May 12, 2016

If I want to edit the Search under this dashboard, how do I do it? I can get to the XML, but that's pretty dense. Can I get back to the Search function that creates this report?

Chrisknox
May 12, 2016

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters