The venerable old-skool Splunk forums are now closed. Feel free to search for old content here, but new posts are no longer supported.

Instead, please visit the thriving community at answers.splunk.com to ask and answer questions about your Splunk deployment and how to get the most out of it.

Forums: SplunkGeneral: Dashboard? View? Am I missing something?

Previous Topic: Index-time field extraction not searchable  |   Next Topic: reload configuration


Posts 1–2 of 2
1
posted by: klee310  |  posts
date: June 12, 2010
permalink

I'm designing an advance dashboard, using the advance Splunk xml; however I'm a little confused at the moment. What is the difference between a dashboard and a view?

Using the Splunk web, I am able to generate a simple dashboard - and upon navigating to the .xml file, I can see that splunk web uses the root element "dashboard"

But when I use the advance Splunk xml to design my own dashboard, I am told to use the "view" root element.

So the big question... what the heck is the difference? dashboard or view?

... and the documentation doesn't help very much either...

I understand a dashboard is a simple view... but is that it? Everything I can do in a dashboard can be done (or enhanced) in a View... but not the other way around???

2
posted by: gkanapathy  |  posts
date: June 12, 2010
permalink

They are the same thing, just different base templates for layouts. It's also complicated because there are two totally different XMLs for creating them, the Simple and the Advanced. Simple is internally translated into Advanced, and is easier to read and write, but more limited.