Splunk® Enterprise

Splunk Dashboard Studio

This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.

Create a dashboard using REST API endpoints

Create or replicate dashboards from different environments using the data/ui/views REST API endpoint. For example, you can move a dashboard from a testing environment to production with the REST API endpoint. The REST API endpoints can also read, update, and delete dashboards.

Format the dashboard definition

When creating a dashboard using REST API endpoints, the components of a dashboard definition must follow a specific format.

Root node
The root node must be <dashboard version="2">, which indicates the dashboard is a Studio dashboard. You can also specify the theme as "light" or "dark" with the theme attribute in the root node. The following is an example of a root node.

<dashboard version="2" theme="dark">

Label
Title your dashboard with the label. The following is an example of a label.

<label>Sample Dashboard</label>

Description
Provide extra context about your dashboard with the description. The following is an example of a description.

<description>Sample Description</description>

Definition
The dashboard's JSON definition must be wrapped in <![CDATA[ … ]]>. The following is an example of how a <![CDATA[ … ]]> wraps around a dashboard JSON definition.

 <definition><![CDATA[
  {
    <JSON definition here>
  }
 ]]></definition>

Meta type
Hide different elements with the meta type. The meta type must be <meta type="hiddenElements">. All hidden elements apply only to View mode and must be contained in JSON wrapped in <![CDATA[ … ]]>.

  • Set hideEdit to "true" to hide the Edit button.
  • Set hideOpenInSearch to "true" to remove the ability to open and edit a query in the full Search experience.
  • Set hideExport to "true" to remove the ability to export dashboards.

The following is a meta type example.

<meta type="hiddenElements"><![CDATA[
  {
    "hideEdit": false,
    "hideOpenInSearch": false,
    "hideExport": false
  }
]]></meta>

Create a dashboard

You can create a dashboard with the following steps.

  1. Write your initial REST command. The command uses the following structure: https://<host>:<mPort>/servicesNS/<user>/<app_name>/data/ui/views. For example, your REST command might look like the following:
    curl -k -u admin:pass https://localhost:8089/servicesNS/admin/search/data/ui/views \
    
  2. Write your header request parameter. For example, your header request parameter might look like the following:
    --header 'Content-Type: application/x-www-form-urlencoded' \
    
  3. Write the name data request parameter with the ID of your dashboard. For example, your request parameter might look like the following:
    --data-urlencode 'name=sample_dashboard' \
    
  4. Write the eai:data data request parameter. For example, your request parameter might look like the following:
    --data-urlencode 'eai:data=
    <dashboard version="2" theme="dark">
    

Example of creating a dashboard using REST API endpoints

The following example shows how to create a dashboard using the /data/ui/views endpoint.

curl -k -u admin:pass https://localhost:8089/servicesNS/admin/search/data/ui/views \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'name=sample_dashboard' \
--data-urlencode 'eai:data=
<dashboard version="2" theme="dark">
   <label>Sample Dashboard</label>
   <description>Sample Description</description>
   <definition><![CDATA[
{
   "visualizations": {
       "viz_FjzwMaVe": {
           "type": "splunk.singlevalue",
           "options": {},
           "dataSources": {
               "primary": "ds_nPeRRFId"
           }
       }
   },
   "dataSources": {
       "ds_nPeRRFId": {
           "type": "ds.search",
           "options": {
               "query": "index=_internal \n| stats count"
           },
           "name": "Search_1"
       }
   },
   "defaults": {
       "dataSources": {
           "ds.search": {
               "options": {
                   "queryParameters": {
                       "latest": "$global_time.latest$",
                       "earliest": "$global_time.earliest$"
                   }
               }
           }
       }
   },
   "inputs": {
       "input_global_trp": {
           "type": "input.timerange",
           "options": {
               "token": "global_time",
               "defaultValue": "-24h@h,now"
           },
           "title": "Global Time Range"
       }
   },
   "layout": {
       "type": "absolute",
       "options": {
           "width": 1440,
           "height": 960
       },
       "structure": [
           {
               "item": "viz_FjzwMaVe",
               "type": "block",
               "position": {
                   "x": 0,
                   "y": 0,
                   "w": 250,
                   "h": 250
               }
           }
       ],
       "globalInputs": [
           "input_global_trp"
       ]
   },
   "description": "",
   "title": "Sample Dashboard"
}
   ]]></definition>
   <meta type="hiddenElements"><![CDATA[
{
   "hideEdit": false,
   "hideOpenInSearch": false,
   "hideExport": false
}
   ]]></meta>
</dashboard>'

Reading, updating, and deleting a dashboard

You can pull, update, and delete your dashboard using GET, POST, and DELETE HTTP methods. For more details, see data/ui/views/{name} in the REST API Reference manual.

Last modified on 20 August, 2024
Escapes, quotation marks, and deltas in dynamic options syntax   Visualization configuration options

This documentation applies to the following versions of Splunk® Enterprise: 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.1.7, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.2.4, 9.3.0, 9.3.1, 9.3.2


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters