Before you start
Before saving objects such as searches and dashboards, ensure you are in the correct App. Your app will appear in left-hand navigation, or in an Apps dropdown at the top of the page. Set your default app by clicking your name at the top of the screen and selecting 'Preferences.'
Save a search as a dashboard panel
- Change the time range to Last 15 minutes.
- Run the following search.
index=vt_* | stats distinct_count(host) as hostcount - This produces a count of unique host names.
- Click the Visualization tab. The display shows a Line Chart by default.
- Change the Line Chart to Single Value.
- Click Save As and select New Dashboard
- Give it a name. Keep the default permissions setting Private until you are ready to share it.
- Select "Classic" dashboard as the type. ("Studio" offers better formatting options but lacks features Classic has. See Splunk's comparison of features for details.)
- Save to Dashboard
You now have a dashboard with one report panel. To add more report panels, you can either run new searches and save them to this dashboard, or you can edit the dashboard directly.
Dashboard permissions
Dashboards link
- To see all the dashboards available to you in your App, click the 'Dashboards' link above the search bar.
- Change the permissions to your dashboards under Actions/Edit/Edit Permissions.
- You will usually give read access to App (everyone that uses the same App you do) or All apps.
- If you give All Apps read access, any VT Splunk user can see your dashboard, but it will not contain data if they are not authorized for your source index(es). Other users will still only see data they have permission to see.
- Delete your test dashboard with Actions/Edit/Delete
For more information
- Splunk Search Best Practices KB Article (requires login to view).
- Official Splunk dashboard documentation
- Splunk dashboard quick reference guide