DASHBOARDS QUICK REFERENCE GUIDE
Introduction Data format requirements vary by
visualization type. When you create a
Trellis layout
You can use Splunk platform visualizations visualization, you use search commands to
to organize and communicate data insights. generate results in a particular data format.
Visualizations and dashboards let you help This format should provide the fields or values
users monitor or learn about important metrics that you want the visualization to represent.
and trends. You can choose to build dashboards
with Classic Dashboards, our original tool using For example, a single value visualization
Simple XML, or Dashboard Studio, our UI-driven shows a single metric. You can use “…| stats
experience with customizable layouts and count” to generate an aggregated count field In Classic Dashboards, you can apply trellis
advanced visualization tools. that the single value represents. layout to split search results on a field or
aggregation so that a visualization renders in
Visualization Concepts When you hover over visualizations in the
Visualization Picker, search syntax and
several segments. Each segment represents a
value in the split field.
Getting started commands are suggested to help you
generate results in the correct data format. Custom visualizations developer API
You can create visualizations from the Search
page or when you are building a dashboard. Format visualizations Some use cases might require a customized
visualization. With Classic Dashboards, the
Search When creating or updating visualizations Splunk Custom Visualizations developer API
in Search, you can use the Format menu to lets you create custom visualization apps to
Run a search to generate results that configure visualization components.
you want to visualize. Use Splunk Search use and share.
Processing Language (SPL) commands to To customize visualizations in dashboards,
generate results for the visualization type that
Visualization search examples
you can also use Simple XML source code for
you are building. Classic Dashboards, and JSON source code The following examples represent one
for Studio Dashboards. possible use case and search for each
After generating search results, click the visualization type. There are many additional
Visualizations tab to select a visualization Depending on the visualization type, different search and use case options for visualizations.
type and format the visualization. format options are available. For example, you
can configure axis label positioning in a bar or
Dashboard column chart. You can specify different map Bar or column chart
You can create visualizations when you are tiles to change the background of a Choropleth
building or editing a dashboard. Use dashboard map. You can also configure ranges and colors … | stats count by
editor to add new visualizations or reuse for a single value visualization. product
prebuilt content. Compare sales totals
Publish visualizations by product.
Visualization types You can save a visualization as a dashboard Table
There are several visualization options panel or as a report.
available in the Splunk platform. In both … | stats count by
dashboard building experiences, you can use Schedule reports to generate search results product, category
Show sales metric for
a visualization picker interface to select a at a specific time interval. You can opt to
products and their
visualization type. include a visualization with them.
product categories.
Visualization options include: You can also save a visualization as a Area or line chart
dashboard panel. Add it to an existing
• Column, bar, area, and line charts dashboard or use it to begin building a new … | timechart
• Pie charts dashboard. You can create and add more count by product
visualizations to a dashboard or edit the Show sales trends for
• Scatter and bubble charts different products.
dashboard to add and configure content.
• Single value visualizations and gauges Pie chart
• Tables Additional visualizations options
• Maps Custom visualizations … | stats count by
• Custom visualizations (Classic Dashboards Available in Classic Dashboards. Show how a daily category
sales total comprises
only)
To expand the visualization options in your different product
• Custom choropleth SVGs (Dashboard Splunk deployment, you can download categories.
Studio only) custom visualization apps from Splunkbase. Scatter or bubble
Installed custom visualizations appear in the chart
Choose a visualization type that fits your use Visualization Picker.
case and your data. For example, if you are
comparing sales totals for different product … | stats count by
types over a time period, you can use a bar or place, mag, depth
Show earthquake
column chart. To show trends in product sales event counts by
over a time period, you can use a line chart. magnitude, depth,
and location.
Search and data formatting
Data formatting means search result
aggregations, data series grouping, or the
result fields that a search must generate for a
visualization to render.
DASHBOARDS QUICK REFERENCE GUIDE
Single value Dashboard Studio You can also set read and write permissions
associated with specific roles.
…product=“video _ Dashboard Studio is our UI-driven option for
game” building dashboards with customizable layouts Saved searches in dashboards
Show a current sales | timechart count and advanced visualization tools. You can
Saved searches in a dashboard are knowledge
metric for a retail choose to use a grid layout for quickly building
objects with independent permissions. A saved
product. dashboards with snap-to alignment and
search can run with the permissions of the user
source=my _ data. adjustable panel sizing, or use absolute layout
who created it or the user who is viewing its
csv for detailed formatting with free placement,
results, including in a visualization.
sizing, and layering of objects. This dashboard
Choropleth map |lookup geo _ us _
states longitude editor has interactive capabilities and offers a Depending on saved search permissions in your
as Longitude, wide range of visualization choices, including dashboards, some users might see visualizations
latitude as custom choropleth SVGs to illustrate custom that represent a more limited result set. Your user
Show sales totals Latitude maps, floorplans, or objects. role and capabilities determine your options for
for each state in the | stats count by adjusting permissions to manage your dashboard
United States. You can easily customize your dashboards with
featureId user experience.
UI tools. This includes rearranging, resizing,
| geom geo _ us _ and layering objects and using custom images,
states
icons, shapes, and text boxes. While no custom Building Interactive
code is required, you can still choose to Dashboards
access the JSON based source code in “view
Dashboard Concepts mode”. Dashboards can be shared PNG or PDF Drilldown
with on-demand export that maintains the look Drilldown is a tool for creating dashboard
Dashboard and feel of your dashboard. interactivity. You can add drilldown to a
A dashboard is a group of visualizations dashboard visualization to share additional
and contextual content, such as titles and Inputs data insights with users when they click on it.
descriptions, that present information in You can add inputs to a dashboard to capture Use the drilldown editor to add and configure
a visual format. Dashboards use layout user selections or typed text and trigger drilldown in your dashboards.
elements to structure their content. responsive behavior.
Drilldown actions in Classic Dashboards
Dashboard editors Available input types include dropdown and Drilldown can trigger different interactive
Use the dashboard editor to create and edit multiselect selection lists, text fields, and time responses to a user click. You can configure
dashboards in Splunk Web. You have two range pickers. Selection inputs can have static drilldown to open a secondary search,
dashboard editor options, Classic Dashboards, choice values and labels. You can also use a another dashboard, or an external URL in the
or Dashboard Studio, to create and edit search to generate input choices dynamically. browser. You can also use drilldown to trigger
dashboards in Splunk. The editors give you contextual changes in the same dashboard.
Inputs use tokens to represent user selection
access to an editing user interface (UI) and
or typed values. You can use input tokens to You can use tokens to customize content
a Simple XML source code editor for Classic
pass the user-provided value to visualizations in a drilldown target. Use tokens to capture
Dashboards and a JSON source code editor for
or other elements in the dashboard and trigger and pass values to a drilldown target, such
Dashboard Studio. You can use the editing UI
responsive actions. For example, you can use an as a search string or a URL, and customize its
or the source code editor to build dashboard
input token in a search to generate a visualization content. You can also use tokens to trigger
components, change layout, and implement
representing the value that a user selected. interactive content display, such as showing or
interactive behavior.
hiding a panel or updating a visualization title.
You can configure most dashboard functionality Searches
in either the editing UI or in the source code Searches provide the data that visualizations Tokens
editor. Some advanced configurations are only represent in dashboards. Tokens are like programming variables. They
available in Simple XML. represent data that changes, such as a search
You can use different types of searches to
result field, a user selection in an input, a user
Simple XML generate dashboard content.
click for drilldown, a search result field value,
Simple XML is the source code for Classic • Inline search strings directly in a visualization or a flag that you set to trigger interactive
Dashboards that you can use to structure and behavior. As with programming variables, you
customize dashboards. Simple XML is made • Saved searches that you reference in a
can use tokens to capture dynamic values and
up of parent and child elements. Elements can visualization
to access them.
have configuration attributes. Additionally, • Global base searches whose results you
visualization elements use <option> child use with post-process searches to generate Some tokens are predefined in Splunk
elements for formatting and behavior different results in various visualization software. You can also create custom tokens
configuration. to represent additional values or to control
Permissions dashboard behavior.
Most configurations that you make in Simple
Dashboards
XML can also be made in the dashboard editing Token syntax requires dollar signs or quotation
UI. Some customizations are only available in Dashboards are knowledge objects with access marks around a token name. For example,
Simple XML, however. For example, conditional and editing permissions. Your user role and $mytoken$ is a user-defined token can be set
drilldown behavior or configuring responsive capabilities determine your options for creating, by an input, and passed to a search powering
display changes require Simple XML. Use the sharing, and administering dashboards. a visualization. Check Splunk documentation
dashboard source code editor to make these for more details on syntax, including special
If you have the admin role and its default character escaping.
customizations.
capabilities, you can configure dashboard
visibility in different apps in your deployment.
DASHBOARDS QUICK REFERENCE GUIDE
Additional Resources
There are many additional resources to help you with creating
visualizations and dashboards.
Splunk Documentation Custom Visualization Apps (Classic Dashboards only)
docs.splunk.com docs.splunk.com/Documentation/CustomViz
Classic Dashboards and Visualizations (Simple XML) Custom Visualization Developer API documentation
(Classic Dashboards only)
docs.splunk.com/Documentation/SplunkCloud/latest/Viz
docs.splunk.com/Documentation/Splunk/latest/
Dashboard Studio AdvancedDev/CustomVizDevOverview
docs.splunk.com/Documentation/SplunkCloud/latest/ Splunk Dashboard Examples App
DashStudio (Classic Dashboards only)
Topics include guidance on: splunkbase.splunk.com/app/1603/
• Search and data formatting for visualizations Splunk Education courses
• Visualization configurations splunk.com/view/education/SP-CAAAAH9
• Building dashboards in the dashboard editor user interface
Splunk Community
• Building dashboards in source code
community.splunk.com
• Dashboard permissions
• Dashboard interactivity (inputs, tokens, and drilldowns) Splunk user community on Slack
Troubleshooting and reference topics: splunk-usergroups.signup.team/
• Chart display issues
• Searches powering dashboards
• Source code reference
250 Brannan St., San Francisco, CA 94107 [email protected] | [email protected] 866-438-7758 | 415-848-8400 docs.splunk.com
www.splunk.com
Splunk, Splunk>, Data-to-Everything, D2E and Turn Data Into Doing are trademarks and registered trademarks of Splunk Inc. in the United States and
other countries. All other brand names, product names or trademarks belong to their respective owners. © 2021 Splunk Inc. All rights reserved. 21-17496-Splunk-Dashboards Quick Reference Guide-102
