Why does Splunk create a view when I asked for a new dashboard? What's the difference?

[twinspop]

I created a new app, and executed a search. Under Actions, I clicked Add to Dashboard. The save search dialog came up, followed by the Add to Dashboard dialog where I created a new Dashboard. I finished out the dialog box, and executed a new search that I also wanted to add to the Dashboard. Saved the search, went to add it to the newly created Dashboard... but it was not listed as a potential target. I canceled out of the dialog and checked under Views. There's my Dashboard. Why is it a View instead of a Dashboard? What's the difference?

[anwarmian]

Your answer to why when you created a dashboard but it appeared under "Views" pull-down menu is the following:

Check the navigation file (default.xml) (Windows default installation)
C:\Program Files\Splunk\etc\apps\yourApp\default\data\ui\nav\default.xml

or copy the above "nav" folder under:

C:\Program Files\Splunk\etc\apps\yourApp\local\data\ui\nav

The content of the file looks like this:

<nav>
    <view name="flashtimeline" default='true' />
    <collection label="Dashboards">
        <view source="unclassified" match="dashboard"/>
        <divider />
    </collection>
    <collection label="Views">
        <view source="unclassified" />
        <divider />
    </collection>
    <collection label="Searches &amp; Reports">
        <collection label="Reports">
            <saved source="unclassified" match="report" />
        </collection>
        <divider />
        <saved source="unclassified" />
    </collection>
</nav>

Now look at the following collection. Look at the term match="dashboard." It means that if your file name contains the word dashboard it will be placed under dashboard pull-down menu else it will go under view. So change the file name to contain dashboard and it will appear under Dashboard pull-down menu.

<collection label="Dashboards">
    <view source="unclassified" match="dashboard"/>
    <divider />
</collection> 

[freephoneid]

I'm having the same issue & I want my dashboard (so called view) to apprear under "Dashboards" menu. Can any one tell me how to do that??? Splunk documentation is poor in that manner to show exactly how Dashboard menu will contain dashboard.

Is this a bug in splunk 4.2.2 on linux platform??? Can any one confirm????

Thanks!

[gkanapathy]

A Dashboard is a type of View. The other types of Views are Forms and Advanced XML Views.

[sideview · Accepted solution]

That sounds like a bug that your newly-created dashboard was not listed in the list of potential dashboards. If you can reproduce that I would send it in to support@splunk.com so they can track it down and fix it.

As for the semantics, a dashboard is a pretty broad term used for a type of view. I agree it's confusing that when you to into the Manager section it only talks about 'Views'.

For all of the user interface that you see in splunk, with the exception of 'Manager', you are in some kind of 'view' at that point. Some views like the default search view, are more 'searchey' and you wouldnt call them dashboards. Other views are more about providing high level information and drilldown click interaction. These we call 'dashboards'. Although it might seem like there's a hard line in between the two, there really isnt.

[kmattern]

Excellent points, Nick. I actually had to write a document on naming conventions so our internal users and management could understand the difference between an app, dashboard, view, panel, etc. Now we refer to apps as dashboards and everything else as views. Makes them happy but confuses those who understand Splunk's structure.