What does a contest-winning Splunk dashboard look like? In this case, it isn't in a browser tab at all. It hangs on my wall: a live air-traffic radar scope and an analogue clock, rotating on a circular display in my house, rendered entirely as a Splunk dashboard.
I'm delighted that this entry, AirspaceWatch, took first place in the 2026 Splunk Dashboard Contest, "From Data to Insight". This post covers where the idea came from, how it was built using the new custom visualisation framework in Splunk Dashboard Studio and the handful of gotchas that cost me evenings, so they don't have to cost you yours.
You can try a live demo for yourself right now.
The Inspiration
Two things collided.
First, I'd already been developing a 7 inch circular display on the wall (driven by a single-board computer) as part of a different wall-clock project. It looked great but I felt it was underused.
Second, I'd been running an ADS-B receiver for a while, feeding live aircraft positions over Leeds into Splunk and contributing to community flight-tracking networks. For those unfamiliar with ADS-B: nearly every aircraft continuously broadcasts its position, altitude, heading and speed, and a cheap USB receiver picks all of it up. It makes a great free real-time dataset!
When the contest was announced I did a fair amount of head scratching to come up with ideas. I've seen similar competitions before and the pattern across their winners is consistent: an unusual domain, genuinely live data and a visual "hero" element that isn't just another chart. The judging criteria nailed it down further: technical complexity and originality were worth 30% each, so a safe entry built from out-of-the-box charts was never going to cut it. Custom visualisations and a physical form factor attack both at once.
A radar scope on a physical circular wall display, built from two custom visualisations, felt like a strong candidate.
A Dashboard as an Object
AirspaceWatch is a Dashboard Studio dashboard designed for a circular screen. That one constraint drove every design decision:
- An 860 x 860 pixel absolute layout, because the canvas is square and the bezel is round.
- A pure black background, so the corners of the square canvas disappear into the display's bezel and the scope appears to float.
- Two tabs, Radar and Clock, which the display rotates between. One moment it's a wall clock, the next it's the live airspace.
- No inputs, no legends, no chrome. Nobody is standing at a wall display with a mouse (and it isn't touchscreen... yet).
Splunk is at the core of the whole thing: a modular input collecting the data, two custom visualisations rendering it and Dashboard Studio holding it together.
Both visualizations are built on the new custom visualisation framework for Dashboard Studio that arrived in Splunk Enterprise 10.4 and Splunk Cloud Platform 10.4.2604 (framework_type = studio_visualization). It's a big step forward from the classic SimpleXML-era framework: your visualisation is plain JavaScript running in a sandboxed iframe, talking to the dashboard through the Studio API, with its options declared in a config.json. No Backbone, no RequireJS and no mandatory build step, and you can bring any JS library you like (or none, as I did). One thing to note: you'll need Splunk 10.4+ to run these visualisations yourself.
The Data: One Event per Aircraft
AirSpace Watch TA (TA-airspace-watch) is a modular input built with the Universal Configuration Console (UCC) framework that polls a local tar1090/dump1090 receiver every 5 seconds and emits one Splunk event per aircraft, geofenced to 100 nautical miles around my location in Leeds, UK, as sourcetype airspace:adsb. Each event carries hex, callsign, lat, lon, altitude_ft, heading, speed_kts and friends.
The radar panel then needs just one honest piece of SPL: the latest position per airframe over the last two minutes, refreshed every 10 seconds.
`index_adsb` sourcetype=airspace:adsb earliest=-2min latest=now
| stats latest(lat) as lat latest(lon) as lon latest(altitude_ft) as altitude_ft
latest(heading) as heading latest(speed_kts) as speed_kts
latest(callsign) as callsign by hex
| where isnotnull(lat) AND isnotnull(lon)
One row per aircraft. That's the entire dataset for the radar.
The Radar Scope
Custom Viz - Airspace Radar (viz-airspace-radar) is a custom Dashboard Studio visualisation (Canvas 2D, no dependencies) that renders those rows as a proper phosphor radar scope: a rotating sweep (6 seconds per revolution, configurable in the viz options), range rings, a centre cross-hair, heading vectors and callsign plus altitude labels on every contact. I centred it on Leeds Bradford Airport with a 100 nautical mile range.
The important design decision: the animation belongs to the visualisation, not the search. Splunk delivers fresh positions every 10 seconds; the sweep, the glow and the motion run client-side at 60 fps. You get something that feels live without hammering the search tier, and the search itself is pretty lean (although I will probably look at leveraging tstats for some performance gains).
The Clock That Cannot Lie
Custom Viz - Realtime Clock (viz-realtime-clock) sounds like the trivial half. It wasn't.
The analogue face has a smooth-sweep second hand driven by requestAnimationFrame with sub-second interpolation, canvas scaling and configurable everything (face, hands, ticks, glow).
Custom Clock Viz for Dashboard StudioThe subtle bit is time itself. The seed search is just | makeresults | eval _time=now(), and the viz uses Splunk's _time to compute a skew offset against the client's Date.now(). The dial then runs off the corrected time. If the device driving the display has a drifting clock (small single-board computers are terrible for this), the wall clock still shows the indexer's truth. A clock that lies is worse than no clock.
Five Gotchas That Cost Me Evenings
In the order they hurt:
- Custom viz type naming. In the dashboard JSON it's <app-dir>.<viz-folder>, for example viz-airspace-radar.airspace_radar. No splunk. prefix, and the dashboard version must be the string "2", not the number. Get either wrong and you stare at an empty panel with no error.
- Know which framework you're following instructions for. Most custom viz tutorials, scaffolds and forum answers out there still describe the classic framework (Backbone, AMD/RequireJS define(), a webpack build). The new studio_visualization framework is the opposite: a plain visualization.js in a sandboxed iframe plus a config.json, and no build step at all. If a guide mentions define() or webpack, check it matches your visualizations.conf before you burn an evening. I kept both vizzes as dependency-free plain JavaScript on Canvas 2D anyway: the smaller the surface area, the fewer surprises.
- Errors go to the browser console, not splunkd.log. Devtools open, panel selected, or you're debugging blind.
- appserver/static is aggressively cached. If your change isn't showing, hard-refresh and hit /en-US/_bump before you doubt your code.
- visualizations.conf changes need a restart (or debug/refresh). Once the viz is registered you can edit the JS and bump the cache.
Credit where due: Robert Castley's open-source custom visualisation scaffold was the starting point for the viz structure, and Splunk's contest guidance pointed straight at it. The community sharing this material is why entries like mine can exist.
Building Backwards From the Scoring Criteria
The winning combination relied on mapping the submission carefully against the scoring criteria:
- Technical complexity (30%): two custom visualisations plus a UCC modular input, not stock charts.
- Originality (30%): live ADS-B on a circular physical display. I bet nobody else's entry looks like a wall object.
- Practical value (15%): the pattern (headless Splunk driving a physical status display) transfers directly to NOC and SOC wall screens, and the scope viz works for any "things on a scope" data.
- Visual design (15%): dark aviation aesthetic, one custom element per screen, zero clutter.
If you're entering next year, read the criteria first and build backwards from the weights. Half the marks are technical depth and originality; spend your time there.
Try It Yourself
Everything in this post is open source and free to install, and both visualisations work with any data you can shape into their inputs:
👉 Download Custom Viz - Airspace Radar on Splunkbase
👉 Download Custom Viz - Realtime Clock on Splunkbase
👉 Download the AirSpace Watch TA on Splunkbase
👉 Explore the live demos or dig into the source on GitHub
And since the prize for the top three was a .conf26 pass: if you're in Denver, come and say hello. I'll be the one explaining why there's a radar scope in my kitchen! Or better yet, join me at these sessions:
- Build, Test, and Ship: How SCDE and CI/CD gets your apps over the line [DEV1036]
- Expose Existing Splunk App Capabilities to AI Workflows [DEV1682]
- Easier Data Onboarding: Using AI to Improve Data Quality and CIM Compliance [PLA1040]
Want updates like this sent straight to you? Learn how to subscribe to this blog (and follow Labels you care about) in our quick guide.
