This blog post will cover the latest features in Dashboard Studio, released in Splunk Cloud Platform 9.0.2303. Grab a snack, it's a long list of new features.
Panel show/hide is finally here! As you can see in the gif above, Dashboard Studio now supports the ability to conditionally show or hide panels based on whether data is available to display. Let's take a look at how to set that up.
To control the visibility of a dashboard panel, look for the "Visibility" section in the Configuration panel. Select "When data is unavailable, hide element"
This will hide your panel when there is no data to show. This may happen if a search hasn't run yet, or hasn't finished running. As you can see in the gif below, the pie chart does not have any data to return because the $method$ token has not yet been set. In order to hide it until there is data to show, we'll toggle its visibility in Edit mode.
You can toggle visibility for inputs as well, following the same configuration steps.
There are a few limitations to be aware of in this initial release of panel show/hide:
1. You can only toggle visibility based on whether data is available to display or not. If you need additional logic, you can include it in your search. For example:
index=main
…
| eval show = if ($tokenA$ > $tokenB$, "true", "false")
…
| head limit=100 (show=="true")
2. You can only hide objects in the canvas (charts and inputs) in Absolute layout. You can hide global inputs in both Absolute and Grid layouts
3. You cannot hide the Line shape.
You can now also move inputs into the canvas in both Absolute and Grid layouts. After you add an input to your dashboard, you can use the Configuration panel to change its Display from "Above canvas" to "In canvas".
Once you move your input into the canvas, you can interact with the input like any other object: move it around, resize it, and change its background color. In Absolute layout you can also layer the input with other objects. In Grid layout, you can resize inputs by adding rectangle components next to your inputs.
This will allow you to move inputs closer to the specific charts or objects that they are affecting.
The events viewer allows you to view raw events and their fields.
In order to display the field summaries, you will need to add a fieldsummary data source. We recommend that you create a chain search that extends the events viewer search with the fieldsummary command.
At this time, workflow actions are not supported in Dashboard Studio.
If you've been using choropleth maps in Dashboard Studio, we have good news for you. We've updated the Map visualization (splunk.map) to support a choropleth layer, meaning you can now take advantage of the zoom and panning capabilities of the Map visualization for all your choropleth needs.
We've also made big improvements in the Configuration panel for axes charts (bar, column, area, line, scatter, and bubble). You'll now be able to make most modifications directly in the UI.
For example, you can select which fields to use for the x-axis, y-axis, and y2-axis.
You can also specify series colors and the spacing between bars in a bar chart.
There are even more UI configuration options that aren't highlighted here, so we encourage you to check them out for yourself!
We've added two new panel actions for Dashboard Studio: Inspect and Export to CSV.
Select the "info" button on a panel in View mode to launch the trusty Job Inspector.
Select the "download" button to select whether you want to export PNG or CSV.
In Dashboard Studio, when you export a CSV, it will include all search results, even if they are not displayed in the chart. Unlike in Classic (SimpleXML) dashboards, export to CSV in Dashboard Studio works for all search types: base, chain, and saved searches.
There are a number of other enhancements included in this release, that I will quickly mention here:
Check out Dashboard Studio and send in your feedback through Splunk Ideas, and you might see your feature request listed on a future blog's "coming soon" list! We are continuing to work on new capabilities, which are delivered incrementally with Splunk Cloud Platform and Splunk Enterprise releases.
Next up is ….
* This information is subject to change at any time, at the sole discretion of Splunk LLC and without notice. This roadmap information shall not be incorporated into any contract or other commitment. Splunk undertakes no obligation to either develop or deliver any product, features, or functionality described here.
The Splunk platform removes the barriers between data and action, empowering observability, IT and security teams to ensure their organizations are secure, resilient and innovative.
Founded in 2003, Splunk is a global company — with over 7,500 employees, Splunkers have received over 1,020 patents to date and availability in 21 regions around the world — and offers an open, extensible data platform that supports shared data across any environment so that all teams in an organization can get end-to-end visibility, with context, for every interaction and business process. Build a strong data foundation with Splunk.