topic Re: dashboardpanel versus report in Dashboards & Visualizations

dashboardpanel versus report

Mike6960 — Tue, 05 Dec 2017 07:37:49 GMT

Hi, I have a dashboard, this contains several panels. When do u use a panel and when do you choose for a report. There is a lot of information on the internet but I can't find an answer that really explains this for me.

Re: dashboardpanel versus report

woodcock — Tue, 05 Dec 2017 07:55:54 GMT

You use a report when you are sharing a search across several dashboards/panels so that if the search must change, you only need to change it in a single place, instead of inside of every panel.

Re: dashboardpanel versus report

Mike6960 — Tue, 05 Dec 2017 08:58:25 GMT

Thanks, but this is also possible with a panel? (clone from dashboard)

Re: dashboardpanel versus report

niketn — Tue, 05 Dec 2017 10:21:10 GMT

Splunk Report

A report in Splunk is essentially a single Search query that runs to produce a single visualization.
Once scheduled this can be sent as email attachment or embedded to external web pages.
These are saved as savedsearches.conf configuration file in Splunk.
A report can also have a Time Picker input but no other inputs are supported in report.
A Dashboard Panel's search can be opened in new Search Page to be saved as a Report.

Splunk Dahsboard

A dashboard can have one or more searches powering one or more visualizations in a single place.
Dashboard allow several types of inputs besides Time Picker like Text Box, Dropdown etc. Once an input is added Dashboard converts to a form.
Dashboard allow scheduled PDF delivery provided there are no inputs i.e. it is of type <dashboard> and not <form>. Also Custom Visualization/Trellis, post processing search and several features are not supported for Scheduled PDF delivery.
There are two types of Dashboards Simple XML stored as xml and HTML Dashboard stored as html file.
Dashboards can not be embedded into external pages with default Splunk configuration and ideally are not supposed to be embedded.
Existing Report can be added to Dashboard as a Panel.

Please let us know if there are other differences that you are interested in and we can provide further details.

Re: dashboardpanel versus report

Mike6960 — Tue, 05 Dec 2017 11:01:38 GMT

Hi niketnilay , I cant see the benefits of using a report over a dashboardpanel... Is it true that i cant see the difference between a report and a panel when I view them both in a dashboard only when I choose for 'edit'?

"A report in Splunk is essentially a single Search query that runs to produce a single visualization" , isn't this not also the case for a panel?

Re: dashboardpanel versus report

Mike6960 — Tue, 05 Dec 2017 11:05:11 GMT

maybe I am just confused, but it looks like reports-panel-prebuilt panels are more or less the same

Re: dashboardpanel versus report

niketn — Tue, 05 Dec 2017 11:54:33 GMT

Ok it makes sense now. You want to compare Reports with Prebuilt Panel.

Just to begin they are completely different. While both of them are saved templates that can be reused in Dashboards, Reports are based on Search (conf file mentioned in previous comment) and Pre-Built Panels like its name suggests is an XML snippet containingas the root node i.e. :

<panel>
...
...
</panel>

Hence Pre-built Panels can have many features of Simple XML Dashboard which reports do not have. Following are few to name:

<html>
<input>
CSS <style> override
Multiple Visualizations
Custom Visualizations
Trellis
Simple XML configurations
Tokens (Input, Search, Drilldown,Custom, Form etc)
Custom Drilldown

Please refer to one of my recent answers to use a Prebuilt Panel to create our own custom multi-level Dropdown Menu instead of Splunk's default menu. I am sure such things can only be achieved by Prebuilt Panels and not Reports.

Re: dashboardpanel versus report

Mike6960 — Tue, 05 Dec 2017 12:48:08 GMT

but a panel and a pre-built panel are also based on a search?? How would it otherwise get the results?
Strange thing is that besides a report and a pre-built panel you also reuse a (normal) panel, by 'clone from dashboard' . It seems to me that the use of report has really no benefits.

Re: dashboardpanel versus report

cmerriman — Tue, 05 Dec 2017 12:51:51 GMT

Just to expand a little.

if scheduling a Report to run, you can include multiple things like a link to the report/results, the search string, inline results, the csv or a pdf. If just trying to export the results of a Report, you have the options of PDF, CSV, JSON and XML.

a dashboard, however, built with or without reports/prebuilt panels, can only be exported as a PDF. The individual panels have the options to be exported as CSV, JSON and XML, however.

Re: dashboardpanel versus report

niketn — Tue, 05 Dec 2017 17:02:04 GMT

@Mike6960, seems like you want to know the purpose of various options to quickly create panels in a Dashboard. So for whatever reason you have some existing components like prebuilt panel or report or another dashboard with same/similar panel, Splunk gives you flexibility to re-use those at your finger tips. You are not supposed to use all of them, or may use one more often than the other.

panel and a pre-built panel are also based on a search? How would it otherwise get the results?
- Yes, and pre-built panels are just templates. The moment you save it as pre-built panel (based on permission) it may be available in any dashboard within app or global reference. Think of pre-built panel as macro or function in programming where you can
1) Re-use same kind of behavior across your app based on how flexible your template is
2) Avoid re-writing same code
3) Easy maintenance from Single place (reference of pre-built panel is added not the entire code)
I have already given one use case for pre-built panel with Custom Navigation in all Splunk dashboards within App. We also had another use case for Pre-built panel where customer wanted unified look in all Dashboards by having a Trellis with six Single Value visualizations in the first row, which could represent Orders or Customer or Items but a snapshot of the same should always be the first row. For me it was a perfect candidate for Pre-Built Panel, which would show Six Single Values and the token to query would change based on the Dashboard.

...you also reuse a (normal) panel, by 'clone from dashboard'
- When you clone a panel from a dashboard you are creating a duplicate copy of the same code (you don't have to write the code, but you need to maintain consistency in different dashboards)

use of report has really no benefits
- I think I had already called out previous answer in the same thread and also points from @cmerriman.
- You can embed a report to external page but not dashboard.
- If you already have a report which does the work you are interested in (for whatever need it was created for), you can use the same to create a panel in Dashboard.

I am not sure whether it clarifies stuff for you or make things more murky 🙂