Splunk® Enterprise

Dashboards and Visualizations

Splunk Enterprise version 9.0 will no longer be supported as of June 14, 2024. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.

Edit dashboards

Use the dashboard editor to customize dashboard panels, layout, or add interactivity.


Open the dashboard editor

  1. From the Dashboards listing page, open the dashboard that you want to convert.
  2. Click Edit to open the dashboard editor.
  3. Select UI or Source to change the editing mode.
  4. (Optional) Preview dashboard edits as you make them and click Save to save changes. Click Cancel at any point to discard changes.

Change dashboard panel layout

You can change dashboard layout to prioritize specific panels or make room for additional content.

  1. From the Dashboards listing page, open the dashboard that you want to convert.
  2. Click Edit to open the dashboard editor.
  3. Drag and drop panels to reposition them.

Change the dashboard theme

You can change the dashboard theme to dark or light. The default theme is light.

  1. Click Edit from your dashboard to open the dashboard editor.
  2. Use the Dark Theme switch to change the theme of the dashboard.
  3. Save the dashboard and refresh your browser to view the change.

A dashboard saved with dark theme applied will be converted back to light theme when you export to PDF or when you convert it to HTML. Dark theme is not supported for these operations.


Edit a panel search

Update the search driving a particular dashboard panel.

When you are working with inline searches, the dashboard search bar has syntax highlighting and auto-complete features that can help you build a search string. To learn more, see Help reading searches in the Search Manual.

Search editing options

All search types Reports Inline searches and inline pivots
  • Edit the title.
  • Delete the search.
  • View and edit the report in a new window.
  • Open the report search in a new window.
  • Clone to an inline search or pivot.
  • Select a different report for the panel.
  • Select the visualization specified in the report for this panel.
  • Specify an automatic refresh interval delay and indicator option.
  • Edit the search, specifying a new inline search or pivot.
  • Convert the inline search or pivot to a report.
  • Specify an automatic refresh interval delay and indicator option.

Steps

  1. From the Dashboards listing page, open the dashboard that you want to edit.
  2. Click Edit to open the dashboard editor.
    At the top right of each panel, editing icons appear. The first editing icon represents the search for the panel. The search icon varies to represent the type of search being used.
  3. Select the search icon to view configuration options for the search.
  4. Select the search configuration that you want to change. Depending on the option you select, additional configuration dialogs or windows might open.
  5. After editing the search, click Save to save changes to the dashboard.



Edit a panel visualization

Use the dashboard editor to edit a panel visualization for panels that are not generated with pivot or pivot report searches.

If you are working with visualizations generated from pivot or pivot report searches, you can use the Pivot Editor. See Design pivot charts and visualizations with the Pivot Editor for details.


Prerequisites


Steps

  1. From the Dashboards listing page, open the dashboard that you want to edit.
  2. Click Edit to open the editing dashboard.
    At the top right of each panel, editing icons appear. The second icon represents the Visualization Picker. The icon varies to represent the visualization type. The third editing icon represents the visualization Format menu.
  3. (Optional) Use the Visualization Picker to select a different visualization. Make sure that the panel search generates results in the correct format for the new visualization. You can select any visualization, but the panel search results might not render if they are not formatted for the selected visualization.
  4. (Optional) Use the Format menu to configure the visualization.
  5. Click Save to save changes to the dashboard.



Edit dashboard source code

Edit dashboard Simple XML source code to customize settings that are not accessible from the user interface. The dashboard source code editor provides interactive validation as you make updates.

Prerequisites

Steps

  1. From the Dashboards listing page, open the dashboard that you want to edit.
  2. Select Edit to open the dashboard editor.
  3. Click Source to open the dashboard XML source code editor.
  4. Edit the source code.
  5. (Optional) Observe that the editor provides automatic tag closing and validation. The editor displays validation warning or error messages as needed. Hover over a warning or error icon next to a line of source code to view the message for that line.
  6. (Optional) Validation warnings and errors disable the Save button. If the button is disabled, correct any code with validation warnings or errors.
  7. If there are no warnings or errors, the Save button is enabled. Click Save to save the source code edits.


Edit a prebuilt panel

Prebuilt panels cannot be edited in the dashboard editor. Use the Prebuilt Panels page to access a panel source code editor.

Steps

  1. From the home page, navigate to Settings > User Interface > Prebuilt Panels.
  2. Locate the panel that you want to edit and select Edit.
  3. Edit the Simple XML source code.
  4. Click Save. The panel is updated in dashboards that include it by reference.


Additional resources

Last modified on 18 February, 2022
Add panels to dashboards   Edit visualizations

This documentation applies to the following versions of Splunk® Enterprise: 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.1.7, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.2.4, 9.3.0, 9.3.1, 9.3.2


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters