Add and format visualizations

You can use the editing bar to add objects to your dashboard and the Configuration panel in the visual editor to use most formatting options for visualizations. At most, a visualization displays the first 10,000 search results.

If you are using the grid layout, charts are the only visualizations available.

1. Select a chart or other visualization using the visual editor by clicking one of the visualization options in the editing toolbar. For example, to add a chart, click the Add Chart button ( ) and select a chart.
2. Select the chart you want to format on your dashboard to highlight it with the blue editing outline.
3. Set up a data source by adding a new search or selecting an existing data source.
   1. To initiate a new search, add a search to the Search with SPL window if you've selected a chart, or click + Setup Primary Data Source if you've selected a shape.
   2. To select an existing data source, close the Configuration panel and reopen it. In the Data Configurations section, click + Setup Primary Data Source and click + Create Ad hoc Search to create a new search from this window. You can also create a unique ID that describes the search better than the default.
4. To customize your visualization, use the available options in the Configuration panel below the Data Configurations section.
5. For further customization, click the Source Editor () and find your chart in the visualizations stanza. Use dynamic options syntax (DOS) to add dynamic visualizations to your chart.

To learn more about data sources, see Create search-based visualizations with ds.search.

Migrate to the splunk.<type> syntax

The splunk.<type> syntax is required for adding tokens and drilldowns in dashboards, and supports dynamic options syntax. If your visualizations still uses the viz.<type> syntax, you can migrate from viz.<type> to splunk.<type> when your dashboard refreshes. At the beginning of each reload, a banner prompts you to migrate with one click.

You can check the type of your visualizations in the Code section of the visualization's Configuration panel or in the source editor. The following is an example of a visualization stanza for a column chart using the splunk.<type> syntax.

"visualizations": {
    "viz_KabMOTyq": {
        "type": "splunk.column",
         "dataSources": {
             "primary": "ds_c8AfQapt"
         },
         "title": "HTTP Request Methods"
     }
},

Change a visualization type

If your data is formatted correctly, you can change one visualization into another by performing the following steps:

1. In the visual editor, select the visualization that you would like to change.
2. Open the Configuration panel.
3. Select the Visualization Options section.
4. Use the Visualization Type dropdown menu to select the new visualization.