Splunk Dashboards bring meaning to your data in a way that is useful in troubleshooting and translating concepts to others.
Part 1 of this series we discussed step by step how to build a Splunk dashboard. If you have successfully built your first Dashboard…. Congrats!
Now let’s go over key considerations that you always want to keep in mind while building out your Splunk dashboards.
Where should I save my dashboard?
For the purposes of this example, we saved the dashboard in the Search app within Splunk. However, if your organization makes use of applications for various departments, this may impact where your dashboard is saved as well. Considering these factors and who will have access to the dashboard will help you determine the right location to save your new dashboard.
Who should have access to my dashboard?
Well, that depends. For this example, we will keep the dashboard ‘private’. Remember, when you share out a dashboard using App or Global permissions, the dashboard will now be visible to others. Even if they aren’t interested in your work, they will have access to view it, and the environment can start to get cluttered if dashboards become overly shared around the organization. Dashboards are meant to be shared, but ideally should be shared to the appropriate audience. Dashboards allow a wider group of people to ‘talk the same language,’ in that they are all depending on the same data, the same queries for their information.
Sharing your dashboard with others.
At some point, you’ll want to share what you’ve created with others within your workgroup, or you may find yourself building dashboards for other departments. So how do you actually make your work visible to others? This can be done by setting the permissions on the dashboard.
- From the search app, choose “Dashboards”.
- Find “My First Dashboard” that we created earlier.
- Select ‘Edit.’
- Select Edit Permissions.
The permissions dialogue allows you to specify the following options:
Owner: selecting this option keeps the dashboard ‘private’, only visible to the owner.
App: selecting this option sets permissions (read/write)( for users within the same App- in this case the ‘Search’ app).
All apps: sets permissions (read/write) for all users (Global)
As your dashboards become more elaborate, you may consider other concepts just as:
How can I incorporate the results of a saved search in my dashboard?
How can I populate multiple charts using one search (base search)?
How can I click on a chart to ‘drill down’ from one chart to another chart?
Some resources to help you on your way can be found below:
Splunk Dashboard Quick Reference guide:
https://www.splunk.com/pdfs/solution-guides/splunk-dashboards-quick-reference-guide.pdf
Splunk Docs Dashboards and Visualizations
https://docs.splunk.com/Documentation/Splunk/latest/Viz/Aboutthismanual
Always adhere to good spl writing practices
About SP6
SP6 is a Splunk consulting firm focused on Splunk professional services including Splunk deployment, ongoing Splunk administration, and Splunk development. SP6 has a separate division that also offers Splunk recruitment and the placement of Splunk professionals into direct-hire (FTE) roles for those companies that may require assistance with acquiring their own full-time staff, given the challenge that currently exists in the market today.
