Working with dashboard panels

A dashboard contains one or more panels. Learn about the different panel types that you can use in a dashboard.

Inline panel

An inline panel contains a search. The search generates the results rendered in the panel visualization. You can edit an inline search directly using the dashboard editor.

Panel from a report

Create a panel based on a report search and visualization.

You cannot modify the search string in the panel, but you can change and configure the visualization. If the report search changes, the panel using that report updates accordingly.

Depending on your permissions, you can control whether the report is accelerated, scheduled, and embedded. You can also change the report permissions.

Report user context

Reports in dashboard panels can run as the report owner or the report user. These settings can affect data visibility and concurrent search limits.

Option	Description	Data visibility impact	Concurrent search limit impact
Run as owner (default)	Run the report using the permissions of the user who created the report. Scheduled reports always run using report owner permissions.	A report run with owner permissions render search results that some users might not otherwise have permission to see. In some cases, you might want to provide this kind of access. In other cases, you might want to restrict search result visbility.	If a dashboard containing a report-backed panel loads multiple times simultaneously, it can impact the report owner's concurrent search limit. When the limit is reached, the report scheduler causes additional report search runs to be queued for later execution. Dashboard users might see slower panel loading and the report owner might not be able to run searches and reports immediately.
Run as user	Run the report with the permissions of the user viewing the dashboard. Scheduled reports cannot run with user permissions.	If the report accesses data that the current user does not have permission to see, the panel does not render those results.	When the report runs, it counts against the concurrent search limit of the user loading the dashboard, not the report owner.

Use scheduled reports for dashboard panels when possible

Back dashboard panels with scheduled reports whenever possible to reduce search processing load for your Splunk deployment.

Benefits of scheduled reports

Not using scheduled reports can impact search processing loads and concurrent search limits. For example, If fifty users access a particular dashboard, panels not backed by scheduled reports cause their reports to rerun fifty times.

Scheduled reports do not require the search to run each time a user loads the dashboard. Panels backed by scheduled reports show results from the last scheduled run of the report.

Using real-time scheduled reports

To show dashboard users the most current results, back dashboard panels with real-time scheduled reports. This report type runs in the background at all times. It does not launch a new report instance each time a user loads the dashboard. Instead, it shows results for the currently running real-time scheduled report.

Prebuilt panel

Save and reuse Simple XML panels in multiple dashboards. You can display a prebuilt panel in a dashboard by using a reference to the panel. Edit the panel directly to change the title, search, or visualizations in it.

Additional information

• To learn about using the dashboard editor to add or edit dashboard panels, see Add panels to dashboards.
• For more details on panel searches, see Searches power dashboards and forms.
• See Edit dashboards and Edit visualizations to learn more about editing panel visualizations.
• To learn about working with reports, see Create and edit reports and Schedule reports in the Reporting Manual.