Using a third party XML editor
In most cases, you use the Splunk Web dashboard editor to edit Simple XML. See About the dashboard editor to learn more.
If you are using Splunk Enterprise, you can also use a third-party editor to work with dashboard source code files in your deployment.
Splunk Cloud Platform users cannot use a third-party editor because access to dashboard source code files is not available. If you have Splunk Cloud Platform, use the dashboard editor in Splunk Web.
Source code files for dashboards and forms
Dashboard and form source code files can include the following.
- Simple XML
- Static HTML and image files imported by reference
File usage requirements
File system write access
Dashboard source file permissions
After copying dashboard source files, makes sure that you can read and write to them. Read and write permissions on the files are defined separately from dashboard user access permissions.
File directories and locations
Use the local directory for source code files
When you edit Simple XML in the dashboard editor, source code file changes are written to the
/local directory. Put dashboard source code files that you edit with a third-party editor in the
Caution: Do not put Simple XML source files in the
/defaultdirectory. Files in the
/default directory are overwritten on deployment and app updates.
For more information on directories and file precedence, see Configuration file precedence.
File location and permissions
Source code file location depends on the file type and permissions.
Simple XML and prebuilt panel source files
/views directory of an app contains the following files.
- Simple XML files
- Panel files available by reference in a dashboard. See Create and add a panel by reference for more information.
- Legacy Advanced XML files
Put Simple XML and panel source code files in the following locations for each permission type.
|Shared in app||
/html directory in an app contains source files for dashboards converted to HTML.
Put HTML files in the following locations for each permission type.
|Shared in app||
Show source code file changes in Splunk Web
To display changes to dashboard source code files, refresh configurations on your Splunk deployment by using the
After refreshing the instance, reload the edited dashboard.
By default, this directory contains the following two files:
stylesheet attributes in
Import files from the same app
<dashboard script="myScript.js" stylesheet="myStyles.css"> . . . </dashboard>
Import files from another app
<dashboard script="myApp:myScript.js" stylesheet="myApp:myStyles.css"> . . . </dashboard>
Use drilldown for dashboard interactivity
This documentation applies to the following versions of Splunk® Enterprise: 6.5.7, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.6, 7.2.10, 7.1.10, 7.0.0, 7.2.5, 7.2.8, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 7.2.7, 7.2.9, 7.3.0