Key Considerations when Building a Splunk Dashboard

Key Considerations when Building a Splunk Dashboard

Splunk Dashboards bring meaning to your data in a way that is useful in troubleshooting and translating concepts to others.

Part 1 of this series we discussed step by step on how to build a Splunk dashboard.  If you have successfully built your first Dashboard…. Congrats!

Now lets go over key considerations that you always want to keep in mind while building out your Splunk dashboards. 

Where should I save my dashboard?

For the purposes of this example, we saved the dashboard in the Search app within Splunk. However, if your organization makes use of applications for various departments, this may impact where your dashboard is saved as well. Considering these factors and who will have access to the dashboard will help you determine the right location to save your new dashboard.

Who should have access to my dashboard?

Well, that depends.  For this example, we will keep the dashboard ‘private’.  Remember, when you share out a dashboard using App or Global permissions, the dashboard will now be visible by others.  Even if they aren’t interested in your work, they will have access to view it, and the environment can start to get cluttered if dashboards become overly shared around the organization.  Dashboards are meant to be shared, but ideally should be shared to the appropriate audience.   Dashboards allow a wider group of people to ‘talk the same language’, in that they are all depending on the same data, the same queries for their information.

Sharing your dashboard with others.

At some point, you’ll want to share what you’ve created with others within your work group, or you may find yourself building dashboards for other departments.  So how do you actually make your work visible to others?  This can be done by setting the permissions on the dashboard.

  1. From the search app, choose “Dashboards”.
  2. Find “My First Dashboard” that we created earlier.
  3. Select ‘Edit’.
  4. Select Edit Permissions.

The permissions dialogue allows you to specify the following options:

Owner: selecting this option keeps the dashboard ‘private’, only visible to the owner.

App:  selecting this option sets permissions (read/write)( for users within the same App- in this case the ‘Search’ app).

All apps: sets permissions (read/write) for all users (Global)

As your dashboards become more elaborate, you may consider other concepts just as:

How can I incorporate the results of a saved search in my dashboard?

How can I populate multiple charts using one search (base search)?

How can I click on a chart to ‘drill down’ from one chart to another chart?

Some resources to help you on your way can be found below:

Splunk Dashboard Quick Reference guide:

https://www.splunk.com/pdfs/solution-guides/splunk-dashboards-quick-reference-guide.pdf

Splunk Docs Dashboards and Visualizations

https://docs.splunk.com/Documentation/Splunk/latest/Viz/Aboutthismanual

Always adhere to good spl writing practices

Splunk Query Optimization – 20 Tips for Writing Better SPL PLUS Additional Resources

About Aditum

Aditum’s Splunk Professional Services consultants can assist your team with best practices to optimize your Splunk deployment and get more from Splunk.

Our certified Splunk Architects and Splunk Consultants manage successful Splunk deployments, environment upgrades and scaling, dashboard, search, and report creation, and Splunk Health Checks. Aditum also has a team of accomplished Splunk Developers that focus on building Splunk apps and technical add-ons.

Contact us directly to learn more.