Splunk® Enterprise

Dashboards and Visualizations

Acrobat logo Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. Click here for the latest version.
Acrobat logo Download topic as PDF

Working with dashboard panels

A dashboard contains one or more panels. Learn about the different panel types that you can use in a dashboard.

Inline panel

An inline panel contains a search. The search generates the results rendered in the panel visualization. You can edit an inline search directly using the dashboard editor.

Panel from a report

Create a panel based on a report search and visualization.

You cannot modify the search string in the panel, but you can change and configure the visualization. If the report search changes, the panel using that report updates accordingly.

Depending on your permissions, you can control whether the report is accelerated, scheduled, and embedded. You can also change the report permissions.

Report user context

Reports in dashboard panels can run as the report owner or the report user. These settings can affect data visibility and concurrent search limits.

Option Description Data visibility impact Concurrent search limit impact
Run as owner (default) Run the report using the permissions of the user who created the report.

Scheduled reports always run using report owner permissions.
A report run with owner permissions render search results that some users might not otherwise have permission to see. In some cases, you might want to provide this kind of access. In other cases, you might want to restrict search result visbility. If a dashboard containing a report-backed panel loads multiple times simultaneously, it can impact the report owner's concurrent search limit. When the limit is reached, the report scheduler causes additional report search runs to be queued for later execution.

Dashboard users might see slower panel loading and the report owner might not be able to run searches and reports immediately.
Run as user Run the report with the permissions of the user viewing the dashboard.

Scheduled reports cannot run with user permissions.
If the report accesses data that the current user does not have permission to see, the panel does not render those results. When the report runs, it counts against the concurrent search limit of the user loading the dashboard, not the report owner.

Use scheduled reports for dashboard panels when possible

Back dashboard panels with scheduled reports whenever possible to reduce search processing load for your Splunk deployment.

Benefits of scheduled reports

Not using scheduled reports can impact search processing loads and concurrent search limits. For example, If fifty users access a particular dashboard, panels not backed by scheduled reports cause their reports to rerun fifty times.

Scheduled reports do not require the search to run each time a user loads the dashboard. Panels backed by scheduled reports show results from the last scheduled run of the report.

Using real-time scheduled reports

To show dashboard users the most current results, back dashboard panels with real-time scheduled reports. This report type runs in the background at all times. It does not launch a new report instance each time a user loads the dashboard. Instead, it shows results for the currently running real-time scheduled report.

Prebuilt panel

Save and reuse Simple XML panels in multiple dashboards. You can display a prebuilt panel in a dashboard by using a reference to the panel. Edit the panel directly to change the title, search, or visualizations in it.

Additional information

Last modified on 01 November, 2016
Create a dashboard
Add panels to dashboards

This documentation applies to the following versions of Splunk® Enterprise: 6.5.7

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters