This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6
A view is a page within Splunk Web. For example, when you're using the Search App, each different page is one view. The main search view, called flashtimeline is located at:
http://localhost:8000/en-US/app/search/flashtimeline
Replace host and port with your installation host and port.
Build your own view if you want to create a page within Splunk Web. For example, maybe you want to make a form search for your help desk App. Maybe you want to create a series of dashboards for business analysis, or to report on activity in your network operations center. You can build your own view with Splunk's view building syntax. Start with the simple syntax described in this section and then move on to the advanced syntax, described in the next section.
First, decide where you want your view to show up. Do you want to add it to a new App or an existing App? If you're creating a new App, you'll want to start with app builder. If you're adding to an existing App, navigate to that App in Manager and add a new view. You'll need to make sure your view shows up in your navigation menus.
Next, index relevant data for your view. If you haven't already, get your data into Splunk. Set up data inputs for the source you want to index. Optionally send your data to an App-specific index, or send it to the default index if you don't want to segregate it.
You may also want to add knowledge objects to your App, like saved searches, event types and tags. Saved searches and reports are useful for any dashboard. Learn more about how to configure saved searches for your App. Add other knowledge objects, like event types, fields and tags. Learn more about knowledge objects in the Knowledge Manager Manual.
Now, you're ready to build a view. If you're just starting out and want to do something quick, create a simple dashboard. Most dashboards reference saved searches and reports. You can also include web resources in your dashboard.
Finally, set permissions on your views. You must make your objects -- saved searches, reports, etc -- readable to any user who has access to the view, or the searches will not display. You can also make these objects writable, if you want to let users customize the saved searches, reports and other objects. Your App users can always create objects within their own private directories, but you may want to let them share any objects they create at the App level. Set App permissions by following these instructions.