Dashboards and forms
Use dashboards and forms to visualize, organize, and share data insights.
Dashboards and forms have one or more rows of panels. Each panel contains a visualization, such as chart, table, or map. In each panel, a search generates data for the visualization.
Forms are different from dashboards because they include
<input> elements, such as text boxes or radio buttons, for user interactions. You can configure elements in a form, such as a panel, to respond to user input by customizing the searches that drive visualizations or changing other behavior.
For more details on building a
<form>, see the Simple XML Reference.
Anatomy of dashboards and forms
See the Simple XML Reference for complete information on dashboard and form element hierarchy.
|top-level element||<dashboard> or <form>|
|Global search||Global search is for use with post-process searches. Post-process searches have limitations. See Post-process limitations.
|Form inputs (Forms only)||<fieldset>|
|Rows||Each row contains one or more panels.
|Panels||Each panel contains an optional title, optional inputs, and one or more visualizations. See Dashboard panels for the types of panels available.
|Visualizations||A visualization displays data returned from a search.
<chart> <event> <map> <single> <table>
|Search||A search for a visualization.
<search id="[identifier]"> Base search for post-process searches.
<search base="[id]"> Post-process search referencing a base search.
<search ref="[report] [ app="[app name]" ]> Reference a search from a report. Reference to app is optional.
|Options||Properties specific to a visualization.
<option name="[option name]">
Searches power dashboards and forms
This documentation applies to the following versions of Splunk Cloud™: 7.0.13, 8.2.2104, 7.2.9, 7.2.10, 8.0.2006, 8.0.2007, 8.1.2008, 8.1.2009, 8.1.2011, 8.1.2012 (latest FedRAMP release), 8.1.2101, 8.1.2103