Splunk Cloud Platform

Dashboards and Visualizations with Simple XML

Dashboards and forms

Use dashboards and forms to visualize, organize, and share data insights.

Dashboards and forms have one or more rows of panels. Each panel contains a visualization, such as chart, table, or map. In each panel, a search generates data for the visualization.

Forms are different from dashboards because they include <input> elements, such as text boxes or radio buttons, for user interactions. You can configure elements in a form, such as a panel, to respond to user input by customizing the searches that drive visualizations or changing other behavior.

For more details on building a <dashboard> or <form>, see the Simple XML Reference.

Anatomy of dashboards and forms

See the Simple XML Reference for complete information on dashboard and form element hierarchy.

Element Description
top-level element <dashboard> or <form>
Title <label> (Optional)
Description <description> (Optional)
Global search Global search is for use with post-process searches. Post-process searches have limitations. See Post-process limitations.

<search id="[identifier]">

Form inputs (Forms only) <fieldset>
Rows Each row contains one or more panels.


Panels Each panel contains an optional title, optional inputs, and one or more visualizations. See Dashboard panels for the types of panels available.


Visualizations A visualization displays data returned from a search.

<chart> <event> <map> <single> <table>

Search A search for a visualization.

<search id="[identifier]"> Base search for post-process searches.

<search base="[id]"> Post-process search referencing a base search.

<search ref="[report] [ app="[app name]" ]> Reference a search from a report. Reference to app is optional.

Options Properties specific to a visualization.

<option name="[option name]">

Last modified on 29 June, 2017
Searches power dashboards and forms   Dashboard examples

This documentation applies to the following versions of Splunk Cloud Platform: 8.2.2112, 8.2.2201, 8.2.2202, 9.0.2205, 8.2.2203, 9.0.2208, 9.0.2209, 9.0.2303, 9.0.2305, 9.1.2308 (latest FedRAMP release), 9.1.2312, 9.2.2403

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters