Splunk® Enterprise

Splunk Dashboard Studio

Add and format visualizations

You can use the editing bar to add objects to your dashboard and the Configuration panel in the visual editor to use most formatting options for visualizations. At most, a visualization displays the first 10,000 search results.

If you are using the grid layout, charts are the only visualizations available.

  1. Select a chart or other visualization using the visual editor by clicking one of the visualization options in the editing toolbar. For example, to add a chart, click the Add Chart button ( The Add chart button in the editing toolbar. ) and select a chart.
  2. Select the chart you want to format on your dashboard to highlight it with the blue editing outline.
  3. Set up a data source by adding a new search or selecting an existing data source.
    1. In the Search section of the Select data source panel, select + Create search.
      1. To select an existing data source, choose a search from those listed in the Search or Saved search sections of the Select data source panel.
      2. Select + Set up primary data source if you've selected a shape.
  4. Name your data source in the Data source name field.
  5. Add your search to the SPL query field.
  6. (Optional) Add a unique ID to the Data source ID field to create a unique ID that describes the search better than the default.
  7. Select Apply and close.

To customize your visualization, use the available options in the Configuration panel below the Data sources section.

For further customization, click the Source editor (The source editor icon) and find your chart in the visualizations stanza. Use dynamic options syntax (DOS) to add dynamic visualizations to your chart. See Dynamic options in Dashboard Studio to learn more about dynamic options.

To learn more about data sources, see Create search-based visualizations with ds.search.

Round visualization corners

To round the corners of your visualization, do the following steps:

  1. Select your visualization. A highlighted blue border confirms you've selected the visualization.
  2. Navigate to the Configuration panel and find the Color and style section.
  3. Select Independent corner radius or specify a value for Corner radius.
    1. Independent corner radius provides the option to change each corner separately in the visualization.
    2. Corner radius changes all corners to the same value.

The following image shows the difference between a column chart with and without rounded corners.

Two column charts side by side. The left chart has rounded corders. The right chart has corners at a 90 degree angle.

Migrate to the splunk.<type>syntax

The splunk.<type> syntax is required for adding tokens and drilldowns in dashboards, and supports dynamic options syntax. If your visualizations still uses the viz.<type> syntax, you can migrate from viz.<type> to splunk.<type> when your dashboard refreshes. At the beginning of each reload, a banner prompts you to migrate with one click.

You can check the type of your visualizations in the Code section of the visualization's Configuration panel or in the source editor. The following is an example of a visualization stanza for a column chart using the splunk.<type> syntax.

"visualizations": {
    "viz_KabMOTyq": {
        "type": "splunk.column",
         "dataSources": {
             "primary": "ds_c8AfQapt"
         },
         "title": "HTTP Request Methods"
     }
},

Change a visualization type

If your data is formatted correctly, you can change one visualization into another by performing the following steps:

  1. In the visual editor, select the visualization that you would like to change.
  2. Open the Configuration panel.
  3. Use the General dropdown menu to select the new visualization.
Last modified on 10 September, 2024
Data source options and properties   Area and line charts

This documentation applies to the following versions of Splunk® Enterprise: 9.3.0, 9.3.1


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters