This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6
Use dashboards to highlight interesting and useful aspects of your data, link to important searches and display common reports. Each dashboard is made of one or more panels and each panel contains a search and a visual summary of that search. Panels are laid out next to or on top/beneath each other. Panels contain:
You can also include web resources to your dashboard panels.
Splunk ships with a few default dashboards in the Search app. All the links under the Status menu are dashboards. Also, the default view for the Search app is a dashboard, located at:
http://localhost:8000/en-US/app/search/dashboard
Note: Replace localhost:8000 with your configured host and port.
Splunk provides two different XML syntaxes for building dashboards -- simple and advanced. Most dashboards can be built via Splunk's visual dashboard editor, which writes out in simple dashboard syntax. However, not all modules are available for the simple dashboard so if you'd like to build something more sophisticated, use the advanced syntax.
Dashboards are built on searches and reports -- saved searches and reports or searches you specify in your dashboard XML configuration. If you specify a saved search in your dashboard, Splunk uses the most recent results from that search. So you can set up a search to run on a schedule and your dashboard will use cached results. Use saved searches if you have a lot of long running searches or you expect a lot of people will be using the same dashboard at the same time. If you'd like your dashboards to display results in real time, build a search string directly into the dashboard.
Before you build your dashboard, read more about configuring saved searches.