Visualize Data

Now that we've got some data and a report, let's add a dashboard with a visualization to our app.

  1. From the app in Splunk Web, click the Reports tab.
  2. Next to the report you created earlier, click Open in Search.
  3. Above the search bar, click Save As, then select Dashboard Panel.
  4. In the Save As Dashboard Panel dialog box, select the following options:
    • Next to Dashboard click New. We'll create a new dashboard because we don't have any writeable dashboards to add our report to. The dashboards that your app already has, such as Search, are default dashboards that are not writeable.
    • For Dashboard Permissions click Shared to App. Private dashboards are saved to the user's local app's /local directory. Dashboards that are shared to the app are saved to the app's /local directory.
    • For Dashboard Title, provide a title.
    • Optionally, provide a description and panel title.
    • For Panel Powered By, click Inline Search so that you can edit the search directly from the dashboard. If you select Report, your dashboard references the saved search.
    • If you your report is set to run on a schedule, this panel takes the most recent results of the scheduled run if available rather than running the report again. For more about scheduled reports, see Schedule reports in the Reporting Manual. For more the types of searches that can power dashboards, see Searches power dashboards and forms in the Dashboards and Visualizations manual.

  5. Click Save, then click View Dashboard.

Recap

Let's take a look at your dashboard. Look at your app's /local folder and noticed that it now has a /data/ui/views subfolder with a new .xml file matching the name of the dashboard you just created.

Dashboards are by default defined using Simple XML. For more, see Simple XML Reference in the Dashboards and Visualizations manual.

The label and description fields define the title and description text displayed in the upper left corner of the dashboard:

Simple XML uses row and panel objects to organize content on dashboards. This example has only a single row, but you can add any number of rows to a dashboard. Each panel can also have a title attribute that appears at the top of the panel.

In this dashboard, we're using a table visualization that displays a set of search results. The table object can embed a search inline or reference a saved report. In this case, the object is an embedded copy of the report we created earlier.

The table also includes a set of attributes describing how to display data, including options to display 20 results per page and to control how drilldown works.

Drilldown is a powerful option that allows you to control how users navigate panels in your app. For more, see Use drilldown for dashboard interactivity in the Dashboards and Visualizations manual.

For a list of the different built-in visualizations, see Visualization reference in the Dashboards and Visualizations manual.

To find out how to create your own custom visualizations, see Tutorial: Create a custom Splunk view.

Next step

Change navigation