Create simple dashboards with the visual dashboard editor

Create simple dashboards with the visual dashboard editor

Splunk's visual dashboard editor enables you to create simple dashboard views quickly without touching a line of code. All you need to get going is a set of saved searches and saved reports that Splunk can use to populate dashboard panels with useful metrics and charts.

Note: The visual dashboard editor is great for getting simple but functional dashboards up and ready for use in a matter of minutes. However, if you'd like to increase the complexity of a dashboard that you've created with the visual dashboard editor, and perhaps do things with it that you can't achieve through the visual editor, you can. For more information, see the "Build dashboards" section of the Developer manual, specifically the section on simple dashboard development.

Starting out

• Open the Actions drop-down list and click Create new dashboard....
• Name your new dashboard. Designate a unique ID for it and give it the Name that it will be identified by in the top-level navigation menu.
• Click Create to create your new dashboard.
• When your new dashboard appears, it is empty. To start defining panels for it, click Edit the dashboard to open the visual dashboard editor.

Create your first panel

In the visual dashboard editor, start by choosing a Panel type. There are four varieties of dashboard panels:

• The Data table panel type presents report results in tabular format:

• The Chart panel type displays report results as a chart. The Chart panel type takes the chart formatting parameters from the saved report that feeds into it. So if a chart panel is displaying a column chart and you'd rather see a stacked area chart, you have to change the formatting parameters of the saved report that you've associated with the panel.
  • Note: If you want your charts to display in the dashboard with custom formatting (a pie chart instead of the default bar chart that the search might otherwise produce, specific labels for the chart, x-axis, and y-axis, and so on) you have two options:
    • Make sure that the panel is associated with a saved report containing the required chart formatting parameters (as opposed to a saved search, which does not include chart formatting information).
    • Override the default chart formatting by modifying the simple syntax dashboard XML for the panel. For more information, see "Editing dashboards created with the visual dashboard editor," below.

• The Single value panel type displays a single numerical value as its result. For example, you could connect this to a search that returns the total number of 404 errors in your server over the past hour, or which displays the average access delay for a webserver. The panel retrieves the value from the first field in the first result.

• The Event listing panel type displays a listing of events returned by a search. This panel type is good for searches for particularly rare kinds of events, such as events that contain a significant but uncommon error message.

Enter a name for the panel and then select a saved search or report to associate with it. Click Add panel to add your new panel to the Panel layout section.

Note: We recommend that you set up your dashboard panels to use scheduled searches when it's possible, especially if you expect them to have a significant number of users. When you use a scheduled search to populate a dashboard panel, Splunk just retrieves the data associated with the last scheduled run of that search when the dashboard is refreshed. This impacts system performance far less than if you have it rerun all of the dashboard reports from scratch at each refresh, and it helps you avoid situations where too many reports are being run concurrently by multiple users.

For more information about defining scheduled searches, see "Schedule saved searches" in this manual.

Set up the dashboard panel layout

Create additional panels using the same method as the first one. As they appear in the Panel layout section, you can click their titles and drag them to adjust their arrangement in the dashboard.

The visual dashboard editor enables you to set up dashboards with rows of one to three panels. By default Splunk sets these up so that each panel in a row has an equivalent width, but the panel height can differ depending on the panel type and the information the panel is displaying.

Here are a few guidelines that you might want to follow when creating dashboard layouts with groups of panels.

• Because single value panels are small, they appear best when arranged in rows of three. They display too much white space when arranged in rows of one or two.
• Event listing panels display best in single panel rows, because they display lines of event data that would otherwise need to be seen via a horizontal scroll bar.
• Data table panels and chart panels work best in rows of one or two panels. You can mix table and chart panels together on the same row, but data table panels can vary in height depending on the length of the tables populating them (consider having the searches that feed them return only the top or last five values).

Here's an example of a dashboard layout that uses the above guidelines. Note that the top row contains three single value panels, the middle row has just one event listing panel, and the bottom row has a chart panel and data table panel, respectively.

Note: Most of these display issues can be dealt with by simple adjustments to the XML code behind the dashboard. You can add paging controls for long data table panel types, group panels together under the same heading, change chart formatting parameters, and more. You can access the XML by clicking Edit Name/XML at the bottom of the visual dashboard editor window. For more information about editing XML for dashboards created with the visual dashboard editor, see "Simple dashboards" in the Developer manual.

Add inline search strings to dashboard panels

The visual dashboard editor enables you to edit your dashboard panels so that they run inline search strings instead of saved searches. Click Edit panel on a panel that you've added to the editor. In the Edit panel window, you can edit the current settings for the panel, but you can also switch from a Saved search to an Inline search string.

Select Inline search string, place your inline search string in the field that appears for it, and then enter the search time range by placing relative time modifiers in the Earliest time and Latest time fields.

Note: Keep in mind that the visual dashboard editor does not enable you to set up the formatting parameters for chart panels. If you design a chart panel with an inline search and find that you want to adjust the chart formatting, you have to edit the simple syntax dashboard XML behind the dashboard.

Editing dashboards created with the visual dashboard editor

You can edit any dashboard that was created with the visual dashboard editor (or which uses the simple dashboard syntax) by bringing up the dashboard and then clicking on Edit dashboard... in the Actions menu. The visual dashboard editor appears.

Select Edit name/XML to edit the dashboard name and the simple syntax dashboard XML behind the dashboard. For more information about editing XML for dashboards created with the visual dashboard editor, see "Simple dashboards" in the Developer manual.

Select Edit permissions to expand or restrict the role-based read and write permissions for the dashboard. When you set dashboard permissions you can also define the app's availability. The dashboard can be:

• A private view available only to yourself.
• Available to one app only (the app it was designed in).
• "Globally" available to all Splunk apps in your system.

Managing dashboard navigation

Because dashboards are a type of view, by default any new dashboard you create will appear in the View drop-down list in the top-level navigation menu. You can edit the code behind the navigation menu to:

• Change the the location of your unclassified dashboards. You can move dashboards to existing lists (or "view collections") in the navigation menu, or create new lists for them.
• Create nested collections (view collections within navigation bar lists) that classify similar dashboards together. For example, under your Dashboards dropdown, you could have an "Web Server" collection that groups together a set of dashboards that display different kinds of firewall information for your web server.

Note: Navigation is managed on an app by app basis. If your dashboard has been promoted globally to all of the apps in your system, it initially appears in the default drop-down list for "unclassified" views in those apps' top-level navigation menus. Users with write permissions for those apps can move the dashboard to its proper location in the app navigation menus as appropriate.

If you have write permissions for your app, you can access its navigation menu code by opening Manager, clicking Navigation Menus, and then clicking the name of the navigation menu for your app. See the "Customize navigation menus" topic in the Developer manual for details about working with the navigation menu code.