Menu
I'm trying to figure out why anyone would want to create a dashboard in Splunk. Views allow you to add forms along with any charts and searches, while dashboards do not. So, why would I want to make a dashboard? Is there any advantage of one vs the other?
349
Splunk is a software platform widely used for monitoring, searching, analyzing and visualizing the machine-generated data in real time. It performs capturing, indexing, and correlating the real time data in a searchable container and produces graphs, alerts, dashboards and visualizations.
Reports are basically saved searches that you can access by clicking a link. They can be referenced by dashboards in order to create specific panels, and you can accelerate their performance with Splunk's acceleration option. You cannot accelerate a dashboard without leveraging a report or a data model of some sort.
There are three kinds of dashboard that you will typically create with Splunk: Dynamic form-based dashboards. Static real-time dashboards. Dashboards as scheduled reports.
In Splunk, there are a lot of options for creating a dashboard. For instance, you have several visualization types, forms, fields, filters, colors, and drill-down options.
Hmmm... not sure I'd agree with the answer above... They are all "views", one way of looking at it, is that forms and dashboards are all stored under the same locations, whether it be accessed through the GUI (under 'Manager>>User Interface>> Views'), or it be accessed through the CLI (e.g. $SPLUNK_HOME/etc/apps/<yourApp>/default/data/ui/views/). Additionally in advanced XML they all start with the opening tag, "<view>".
To add a bit more...
A dashboard is a type of view (typically referring to a view with no user control), in advanced XML, you start it with the <view> tag.
A form is a type of view (typically referring to a view with user control), in advanced XML, you start it with the <view> tag. It's just a mix-up in terminology.
Perhaps the confusion lies with the differences between Simple XML and Advanced XML. Ultimately Splunk will convert Simple XML to Advanced anyway when it reads it.
117
A dashboard is a special case of view.
A normal view would allow you to change search conditions and hence view the changed results.
Dashboards are useful to as they consist of multiple panels and can accumulate data from multiple datasources into one quick view.
For example if you want to view the number of errors and map that against the CPU on the box at the same time, the dashboard comes in handy
21
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
