If you’re new to the Splunk Dashboards app (beta) on Splunkbase and you’re trying to get started with building beautiful dashboards, this blog series is a great place to start. The Splunk Dashboards app (beta) brings a new dashboard framework, intended to combine the best of Simple XML and Glass Tables, and provides a friendlier experience for creating and editing dashboards. Read more about this new dashboarding framework, or catch up on previous posts in this blog series about custom SVG choropleth maps, using Grid layout and Saved Searches, using dashboard defaults for visualizations, and the new Examples Hub.
This post will cover how to configure your inputs in the UI, how to create search-backed inputs, how to set up cascading inputs, and new examples in the Examples Hub. For notes on every feature, see the release notes on Splunkbase.
Previously, all inputs configurations had to be done in source mode (think: defining a token name, setting a default value, populating options in drop down or multi-select inputs, etc.). As of the Splunk Dashboards app (beta) v0.9, all of those configurations can be set in the UI.
There are five supported input types: time range, drop down, multi-select, text, and number. By default, a time range input is added to all new dashboards (learn more about that in our previous v0.8 blog post, "Dashboards Beta v0.8: Examples Hub"). All other inputs can be added from the input menu in the dashboard toolbar.
You can then configure your inputs in the right side panel. For all inputs, you can adjust the title, default value, and token name. Some inputs might have other specific options you can also set for further customization. For example, you can set a min and max value for a number input, as well as the step value.
For drop down and multi-select inputs, you can define static items to be displayed.
If your default value for a multi-select input is “All” or “*”, and you want this selection to be cleared if users select any other value, you can set the property clearDefaultOnSelection to true. If you have a default value specified, clicking “Clear All” will reset to the default value.
You can rearrange your inputs with simple drag-and-drop actions. As a reminder, inputs can be placed only at the top of the canvas, and cannot be moved anywhere else within the canvas like other objects.
You can dynamically populate a drop down or multi-select input by backing it with a search. In this example, we are using a search to return a list of users that will populate a drop down input. Below you can see the search and search results.
First, you will need to associate the data source to the input by specifying the data source ID in the input stanza. This is done in source, or in the code editor in the configuration panel.
Then you will need to add a section called “encoding” that specifies which fields to associate as the label (what shows up in the dropdown) and the value (what is passed through the token). Oftentimes, these will be the same field. Imagine you are returning the results of your search as a table. The leftmost column is 0, the next column to the right is 1, the next is 2, and so on. In this example, we want the “user” field, which is column 0, so we specify that column as follows.
Now, your input is dynamically populated by a search! In this dropdown input example, the selection that is made can now be passed to searches or visualizations using the token name defined for this input.
This functionality can now be used to create cascading inputs: having the selection of one input affect the items shown in another input. In the example below, you can see that the multi-select input is updated with a different set of options every time I select a different user in the first dropdown input.
The first input “Select User” sets a token, $dd1$, which is then passed to the search backing the second input “Select Sourcetype”. You can find this specific example of cascading inputs in the Examples Hub:
Speaking of the Examples Hub... we’ve added new examples for your perusal: Data Center Sensors (screenshot at the top of this blog), Workforce Readiness (see below), and Manufacturing/IoT (also below).
Did you know that the Examples Hub includes things like how to add a chart overlay or annotations to dashboards? They are scattered through the various visualization-specific examples, and I definitely encourage you to check them out! For instance, there are examples of chart overlays in both the area chart examples and the column chart examples page.
You can find an example of annotations in the line chart examples page.
Try out the Splunk Dashboards app (beta) and let us know if you have any questions, enhancement requests, or bugs to report at dashboards-beta@splunk.com and our team will be sure to respond!
*This information is subject to change at any time, at the sole discretion of Splunk LLC and without notice. This roadmap information shall not be incorporated into any contract or other commitment. Splunk undertakes no obligation to either develop or deliver any product, features, or functionality described here.
The Splunk platform removes the barriers between data and action, empowering observability, IT and security teams to ensure their organizations are secure, resilient and innovative.
Founded in 2003, Splunk is a global company — with over 7,500 employees, Splunkers have received over 1,020 patents to date and availability in 21 regions around the world — and offers an open, extensible data platform that supports shared data across any environment so that all teams in an organization can get end-to-end visibility, with context, for every interaction and business process. Build a strong data foundation with Splunk.