Display data with Splunk views

The Web Framework includes a library of Splunk views, which are the UI widgets and form controls that you put on your pages to display a certain type of information, or control some aspect of a search or another view. Splunk views are designed to work with search managers, so they automatically know how to work with them. But mostly, views let you quickly and easily run searches and display results on your page. (In Simple XML, these items are referred to as form inputs and panel visualization elements).

The Web Framework includes views for:

Visualizations

Chart view

The Chart view displays results in a variety of configurable chart types:

The Chart view

Table view

The Table view displays the results of a search:

The Table view

EventsViewer view

The EventsViewer view displays the events from a search:

The EventsViewer view

Single view

The Single view displays a single value:

The Single view

SplunkMap view

The SplunkMap view binds a map to a search that interprets geographic data and displays it on a map. Data with latitude and longitude fields are used to populate map markers according to location:

The SplunkMap view

DataTemplate view

The DataTemplate view is a generic view that provides developers with the ability to render data using the client-side templating engine provided by underscore.js, for example:

The DataTemplate view

Search controls

SearchBar view

The SearchBar view displays a search box where the user can enter a search query, along with a TimeRange view:

The SearchBar view

SearchControls view

The SearchControls view displays controls for the search:

The SearchControls view

Timeline view

The Timeline view displays the timeline for search results:

The Timeline view

TimeRange view

The TimeRange view displays a dropdown list with time-range options for search results:

The TimeRange view

ResultsLink view

The ResultsLink view displays a panel with buttons to open a search in a new tab or window, export results, open the search job inspector, and refresh the page:

The ResultsLink view

Form inputs

Checkbox view

The Checkbox view displays a checkbox and returns a Boolean value indicating whether it is checked:

The Checkbox view

CheckboxGroup view

The CheckboxGroup view displays a group of checkboxes, allowing you to populate a set of checkboxes with a search or use this view like a standard HTML checkbox group:

The CheckboxGroup view

Dropdown view

The Dropdown view displays a dropdown list of options (only one option can be selected):

The Dropdown view

MultiDropdown view

The MultiDropdown view displays a dropdown list of options (more than one can be selected):

The MultiDropdown view

Linklist view

The Linklist view displays a clickable list of options (only one can be selected):

The Linklist view

RadioGroup view

The RadioGroup view displays options as radio buttons:

The RadioGroup view

TextInput view

The TextInput view displays a text box:

The TextInput view

Layout

Layout view

The Layout view manages the chrome and layout of a converted HTML dashboard page.

  • The Splunk bar at the very top of the page provides a link to the Splunk Enterprise home page, a list of apps, and menu options for Splunk Enterprise.
  • The app bar provides links to the app-specific features and views.
  • The footer lists Splunk Enterprise links and copyright notice at the foot of the dashboard.

Each of these Splunk views has a number of properties, methods, and events―properties to customize the view, methods to operate it, and many have events that are fired when the view changes or is clicked. For more, see the Splunk Web Framework Component Reference.