Splunk® Light

Getting Started Manual

Download manual as PDF

Download topic as PDF

Use visualizations in Splunk Light

When you create a dashboard panel, you select how the panel displays the results of a search or report with a visualization. Visualizations are graphical representations of your data, such as a graph, table, or chart. You can change your visualization selection with the Dashboard Panel Editor.

For information about visualizations types, see the Visualization Reference in the Splunk Enterprise Dashboards and Visualizations manual.

Add a visualization to a search and save as a dashboard panel

When you run a search, the visualization tab on the Search page lists visualizations that represent your data based upon your search results. Select a visualization and save the search and visualization as a dashboard panel.

  1. After running a search, select the Visualization tab on the Search page.
  2. Click the Visualization Picker, which is the menu that lists available visualizations.
  3. Select a visualization. The Splunk Light software suggests Recommended visualizations that best represent your data, although you can select any visualization listed.
  4. Select Save As > Dashboard Panel to save your search and visualization as a dashboard panel.

This screen image shows how to add a visualization to a search and save it as a dashboard panel.

Change a visualization on a dashboard panel

Change a visualization on a dashboard panel by editing the panel.

  1. On a dashboard, click Edit.
  2. On the dashboard panel, click the Visualization Picker and select a visualization. The recommended visualizations best represent your data, although you can select any visualization listed.
  3. Click Save.

This screen image shows how to add or change a visualization to an existing dashboard panel.

Edit visualizations using the Dashboard Editor

Edit a visualization to configure its search, type, appearance, and behavior. You can edit visualizations from the Panel Editor or on the Search page. In either location, you can adjust the following visualization components.

This screen image shows how to edit a visualization components from the Search page, including editing the search string, type, and format.

Visualization components Description
Search string Use the dashboard search editor or the search bar to change the query driving the visualization.
Type Use the Visualization Picker to select a visualization type. Ensure that the query generates results in the proper structure for the selected visualization.
Format and behavior Use the Format menu to adjust appearance, drilldown, and other settings for the visualization's user interface.

Formatting and other options vary by visualization type. To compare visualizations and for details about writing queries for different visualizations, see the Visualization reference and Data structure requirements for visualizations in the Splunk Enterprise Dashboards and Visualizations manual.

Add event annotations to a chart

Event annotations allow you to create context for existing line, column, or area charts. When you use annotations, event flags are overlaid onto the chart as a result of a secondary search of a log file, a lookup, or from a data source you've manually added. These secondary annotation searches can only be added in Simple XML while editing a dashboard or panel using the Source option. The secondary search is run at the dashboard level, not at the search level. The following image is an example of a dashboard panel that includes event annotations.

EventAnnoteWarnUse.png

For more information on using event annotations, such as a table of fields that can be used, field requirements, and an example of the XML used to create the dashboard above, please see Event annotations for charts.

View, export, inspect or refresh a visualization

In the Panel Editor you can access and view details of the search that drives the data in a panel. These features are available from icons that are visible when you mouse-over the bottom right of a panel.

This screen image shows how to use the dashboard panel editor to open a search for a visualization in Search. This allows you to inspect details or make modifications to the search that drives the dashboard panel. You can also export results of a search, inspect a search job to view details of the search, or refresh the results of a search in the panel.

Panel Editor components Description
Open the Search You can open a search for a visualization in Search. This is useful to inspect details of the search and perhaps test modifications to it before updating the search in the panel. In the Panel Editor, click the Open in Search icon. A new window opens with the search running in the Search.
Export You can save the results of the search, or a limited set of results, to a file. In the Panel Editor, click the Export icon and specify the format, filename, and number of results to export. Click Export.
Inspect Use the Search Job Inspector to view details of the search. In the Panel Editor, click the Inspect icon. The Search job inspector opens in a new window. In the Panel Editor, click the Inspect icon. The Search Job Inspector opens in a new window.
Refresh You can refresh the results for a search in a panel. This is useful to verify that you are seeing the latest results. In the Panel Editor, click the Refresh icon.
PREVIOUS
Use dashboard panels in Splunk Light
  NEXT
Create forms in Splunk Light

This documentation applies to the following versions of Splunk® Light: 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.3.0, 7.3.1, 7.3.2


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters