Dashboards and forms

Every page in a Splunk app is a view. For example, the search timeline page in the Search and Reporting app is a default view. If you design your own apps you can construct views for them. You can also add views to existing apps.

Dashboards are the most common type of view. A dashboard contains one or more panels, each of which can contain visualizations such as charts, tables, event lists, and maps. Each dashboard panel uses a base search to provide results for the visualizations. Typically, the search returns results when the dashboard is loaded.

A form is a dashboard that provides user inputs to the search, such as a drop-down list, radio buttons, or a text box. A form contains the same options for panels and visualizations that are available for dashboards.

Dashboards and forms can also modify a search (post process the search) to extract and highlight different information from the search in the panels.

Anatomy of dashboards and forms

Dashboards and forms are the two types of views you can create with Simple XML. Their underlying structure is similar, but there are a few minor differences. The following Simple XML elements make up a dashboard or form. Many of these elements are optional. Refer to the Simple XML Reference for more details.

Element	Description
top-level element	<dashboard> or <form>
Title	<label> (Optional)
Description	<description> (Optional)
Global search	Global search is for use with post-process searches. Post-process searches have limitations. See Post-process limitations. See also <search> element. <search id="[identifier]">
Form inputs (Forms only)	<fieldset>   <input>     <text>          <checkbox>     <dropdown>     <multiselect>     <radio>       <search> (to populate input choices)
Rows	Each row contains one or more panels. <row>
Panels	Each panel contains an optional title, optional inputs, and one or more visualizations. See Dashboard panels for the types of panels available. <panel>
Visualizations	A visualization displays data returned from a search. <chart> <event> <map> <single> <table>
Search	A search for a visualization. See <search> element. <search> <search id="[identifier]"> Base search for post-process searches. <search base="[id]"> Post-process search referencing a base search. <search ref="[report] [ app="[app name]" ]> Reference a search from a report. Reference to app is optional.
Options	Properties specific to a visualization. <option name="[option name]">

Differences between dashboards and forms

The layout of rows, panels, and the visualizations in the panels is essentially the same. The main differences between a dashboard and a form in Simple XML are:

• Each has a different top-level element, <dashboard> and <form>.

• Forms have user inputs, such as a time range picker, drop-down lists, radio buttons, or a text box.

• The order of Simple XML elements differ slightly in the source code.

For details on the underlying Simple XML, see the Simple XML Reference. Compare the entries for <dashboard> and <form>.

Dashboard panels

Panels typically contain a search that drives the content of a visualizations in the panel. A panel can contain the following optional elements:

• Title

• Search
  One or more searches that drive the data displayed in the panel. The search can be from several sources:
  • An inline search that you create and edit using the Panel Editor.
  • A report that contains an imbedded search or a pivot.

• User inputs that modify the search results.

• Visualizations that display the data as graphs, tables, or charts.

• HTML encoded text to display messages to the user.

Inline panel

An inline panel is a panel that you can edit with the Dashboard Editor and Panel Editor. You can also edit the child elements of a panel element by editing the Simple XML source code.

You can create an inline panel in the Dashboard Editor. You can also add inline panels to dashboards from Search, Report, and Pivot. See Add panels to a dashboard for details.

Prebuilt panel

A prebuilt panel is a panel that is shared on multiple dashboards. Each dashboard provides a reference to the prebuilt panel to display the panel.

You can convert a panel to a prebuilt panel. You can also create a panel that can be shared using simple XML code.

A dashboard accesses and displays a prebuilt panel with a reference attribute of the <panel> element. Use the optional <app> attribute if the prebuilt panel does not belong to the current app.

<panel ref="SharedDataPanel" app="exampleApp" />

You add a prebuilt panel in the Dashboard Editor by selecting from a list of available panels. You cannot edit a prebuilt panel with the Panel Editor.

See Create and add a panel by reference.

Add panels to a dashboard

There are several ways that you can add a panel to a dashboard.

• From the Dashboard Editor, you can select the type of panel to add. Choose from the following:
  • Create an inline panel.
  • Add a reference to a panel.
  • Add a panel from a report.
  • Clone a panel from another dashboard.
• From the Search page, save the search results as an inline panel.
  See Save the results in the Search Manual.

• From the detail page for a report, save the report as an inline panel.
  See Create and edit reports.

• From the Pivot Editor, save the pivot as an inline panel.

About views

In Simple XML, you can define a view as a dashboard or a form. You can also convert a Simple XML view to HTML that accesses SplunkJS Stack. After converting to HTML, a dashboard or form is no longer considered a Simple XML view.

Editors for Splunk Enterprise dashboards

There are several options for creating and editing dashboards or the visualizations contained within dashboards. This topic provides an overview of the options. For further details, see Create and edit dashboards from Splunk Web.

Dashboard Editor

Use the Dashboard Editor to create dashboards, add panels to dashboards, edit dashboards, create forms, and generate PDFs for a dashboard.

Create a form by creating a dashboard and then adding inputs to the dashboard. See Create and edit forms with the Dashboard Editor for details.

The Dashboard Editor includes a series of dialogs and menus to edit the dashboard.

Editor	Description
Add Panel	Add a panel to a dashboard by selecting from the following options: Create a new inline panel. Add a panel that is based on a report. Add a reference to a prebuilt panel. Clone a panel from another dashboard.
Add Input	Add form inputs and a Submit button to a dashboard.
Panel Editor	Edit inline panels. From the Panel Editor, edit the panel properties, access or edit the panel's underlying search, change the visualization, or configure the visualization.
Visualization Editor	Configure a visualization. Configuration options vary by visualization type.

Access dashboards from Search, Report, or Pivot

You can create dashboards or add panels to a dashboard, when saving a search, report, or pivot.

When you add a panel from the Search page, you create a panel with an inline search. You can modify the search string in the panel without affecting the original search.

When you add a panel from a report or from the Pivot Editor, you can create a panel with an inline search or link directly to the report. If you create a panel with an inline search, you can modify the search string in the panel without affecting the original report or pivot. If you link directly to the report, the contents of the panel change whenever the report changes.

Pivot Editor

From Pivot you can access the Pivot Editor, a tool for creating and editing visualizations. See Design Pivot Charts and Visualizations with the Pivot Editor for details.

Simple XML Source Editor

For many features, you need to edit the source simple XML code.

When you edit the Simple XML for a dashboard you can do the following.

• Control a wide range of dashboard panel formatting properties. See the Chart Configuration Reference for more details.
• Create maps that display location markers.
• Configure drilldown behaviors (such as drilldown clicks that take users to a second dashboard).
• Create HTML panels that display static text, images, and HTML formatting.
• Configure panels with overlay charts.

To learn how to create dashboards with Simple XML, see Build and edit dashboards with Simple XML in this manual.

To learn how to create forms with Simple XML, see Build and edit forms with Simple XML in this manual.

Other source code editors

You can use your favorite source code editor to edit the source code for a dashboard. In addition to editing Simple XML or HTML source, you can edit CSS or JavaScript files accessed by the dashboard.

In this scenario you need access to the Splunk instance on the host server. See About editing simple XML for more information.

Performance configuration for large numbers of dashboards

If you are working with a large number of dashboards, you may want to improve UI performance. You can adjust view caching by changing the max_view_cache_size setting in the web.conf configuration file. For example, if you have 700 dashboards, you can increase this setting to 1000 to improve performance.

For more information about settings in web.conf, see the web.conf spec file in the Admin Manual.