topic Re: Can I have an overview of how Splunk reports and dashboards work? in Dashboards & Visualizations

Can I have an overview of how Splunk reports and dashboards work?

jmulcaster_splu — Sat, 06 Jun 2020 20:17:26 GMT

I have a handful of searches that I want to build into reports and dashboards so I can collaborate with my team. Can you give me a sketch of how Splunk reports and dashboards work?

Re: Can I have an overview of how Splunk reports and dashboards work?

jmulcaster_splu — Thu, 12 Sep 2019 17:56:15 GMT

The Splunk Product Best Practices team provided this response. Read more about How Crowdsourcing is Shaping the Future of Splunk Best Practices.

Dashboards are where search results coalesce into a way to visualize and analyze the meaning in your data.

Note: This answer applies to Splunk Enterprise and Splunk Cloud.

How dashboards help you share insights

A dashboard is a collection of views made up of panels representing your search results. Each panel presents the results of a search, often as a visualizations, such as a table, chart, graph, or even something custom. The dashboard editor enables you to build dashboards using drag-and-drop editing, or using underlying markup Simple XML. You can reuse dashboard panels across various dashboards by creating prebuilt panels.

SPL supports many types of commands that can clarify the lens through which you see your data. For example, you can use transforming commands in your SPL queries to build statistics and advanced visualizations.

Dashboard: A user interface associated with an app that has one or more panels that show search results.
Dashboard editor: An interactive editor available from Splunk Web to create and edit dashboards.
Panel: An individual element on a dashboard that holds one or more search results.
Simple XML: Simple XML source code defines dashboard and form structure, elements, and behavior. Use the Dashboard Editor to build or edit dashboards in Simple XML.
Views: Use views to display information or control some aspect of a search or another view.
Visualization: Visual representation of search results from inline searches, pivots, or reports.
Prebuilt panels: A type of panel that can be shared among various dashboards.
Transforming commands: A type of search command that orders the results into a data table that can be used for statistics and visualization.

How to get started with dashboards

Print the Dashboards Quick Reference Guide. A great item to print and keep on your desk to reference when you need answers. The Splunk Dashboards Quick Reference Guide provides an at-a-glance view of Splunk data visualizations and dashboards.
Transform an existing report. Use the transforming commands to adapt the results of a noisy report into a rich visualization.
Enrich an existing visualization. Modify an existing visualization to discover alternative visualizations to express data insights.
Install the Splunk Dashboard Examples app. The Splunk Dashboard Examples app delivers examples that give you a hands-on way to learn the basic concepts and tools needed to rapidly create rich dashboards using Simple XML.
Create a dashboard. Populate a dashboard with a set of searches that relate to the same context, or use case.
Create Dashboards. Watch the following video to see how to create a dashboard in your Splunk platform.

Re: Can I have an overview of how Splunk reports and dashboards work?

adukes_splunk — Mon, 21 Oct 2019 17:11:34 GMT

Added related video.

Re: Can I have an overview of how Splunk reports and dashboards work?

divyagiri — Thu, 21 May 2020 14:55:23 GMT

,How do I validate the data in the dashboard against the source data?

Re: Can I have an overview of how Splunk reports and dashboards work?

sloshburch — Thu, 21 May 2020 15:40:00 GMT

Hi @divyagiri - I think that will be better handled as a new question all together. In such a post, provide some information about what you're facing. For example, are you trying to validate that the panels are showing all the relevant data? Are you concerned about if that data has all been received yet? Doubts about the underlying search? Issues with the source data before it gets to Splunk? There's a lot of ways this question can go.

Re: Can I have an overview of how Splunk reports and dashboards work?

divyagiri — Fri, 22 May 2020 07:59:11 GMT

Hi @SloshBurch,
My question is how do I make sure that the panels are showing the exact data. For an instance at the source the value is "100" and in the dashboard it should be "100". So is there any check mechanism to validate that data?

Re: Can I have an overview of how Splunk reports and dashboards work?

sloshburch — Fri, 22 May 2020 14:28:47 GMT

Hi @divyagiri - I'm having trouble finding the docs page that shows this, but if you mouse over a dashboard panel then the bottom right will expand to show a number of controls. The first item is a magnifying glass which can be used to open the search in a new window where you can inspect it and validate the underlying data. If those buttons do not appear then it's possible the dashboard creator included an option to hide them. Alternatively, when editing a dashboard you can find similar controls as outlined in the Add controls to a dashboard section of the Create dashboards and panels topic of the Splunk® Enterprise Search Tutorial manual.

I highly recommend that further questions on this be spun up as a new question post so the question can get better visibility and help.

Re: Can I have an overview of how Splunk reports and dashboards work?

emeelan_splunk — Fri, 22 May 2020 15:11:36 GMT

Hi @divyagiri, @SloshBurch is absolutely correct. The best place to begin would be to work through the Splunk Search Tutorial: https://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/WelcometotheSearchTutorial.

It sounds like you're not the one creating the searches that back the visualizations on an existing dashboard? Otherwise, you would see the direct results of your search, called "events" populated in a table before choosing a visualization that represents that data, and then creating a dashboard. The fields that are extracted which group these events are listed to the left of the statistics table. Once you see the results of your data, you can choose a visualization if you've used a command that results in a statistics table. You'll see this option in a tab above the results table.

The Splunk Search tutorial is an excellent place to start, but so is the Splunk Dashboards and Visualizations Manual https://docs.splunk.com/Documentation/Splunk/latest/Viz/Aboutthismanual

And, yes, if someone has shared a dashboard with you and you have the correct permissions or they've set up the option, you can hover over the visualization to "Open in Search" and see the raw data for yourself.

Best,
Eve