In our last installment (Quick Wins #1 – High Value information) , we showed a variety of simple to run, high impact reports.

Today, let’s put some of them on a dashboard.

This process has several steps. We are going to

1. Put a graph on a brand new dashboard, creating the dashboard in the process.
2. Add another graph to that dashboard.
   • (This process extends to a third or more, but you’ll get the hang of it with just two.)
3. Edit the dashboard to move items around and clean up any formatting you may want.
4. Check and change permissions on that dashboard so anyone can see it.

And like the old ​“Choose your own adventure” books, you can pick one of the following (they’re mutually exclusive, though there’s no reason you can’t build the time picker on a clone of the PDF-sending dashboard…)

1. Schedule a PDF of it to be sent each morning,
2. Or add a time-picker so you can select timeframes right on the dashboard.

Creating a new dashboard, adding your first graph or chart.

This step starts where the previous blog ​“Some quick wins, #1” leaves off. I will assume you have a graph you’d like to put on a new dashboard already sitting in front of you.

This set of steps are pretty much the same regardless of where in our app you start.

1. In the upper right, click the button Create Dashboard Panel
   
2. If you are on a version before 6.1:
   1. Fill in a saved report name
   2. Click the radio button for new dashboard
   3. Also add in a dashboard name, and optionally a panel title.
      When finished you’ll have something like this.
      
3. If you are version 6.1 or newer:
   1. Click the radio button for new dashboard
   2. Add in a dashboard name, and optionally a panel title.
      When finished you’ll have something like this.
      
4. Click the Create button.
5. In the resulting dialog, just click the X.
   

We’ll use those other options here in a bit, but for now we want to skip right on ahead and add a second graph.

Adding a second graph to that dashboard

Much like the above, I’m going to assume you can navigate to another pretty graph you want to add to this Awesome Dashboard.

1. In the upper right, click the button Create Dashboard Panel again
   
2. Click the radio button for existing dashboard
3. If you are on a version before 6.1:
   1. Fill in a saved report name
   2. Pick the dashboard name from above and optionally add a panel title.
      When finished you’ll have something like this.
      
   3. Fill in a saved report name
4. If you are version 6.1 or newer:
   1. Pick the dashboard name from above and optionally add a panel title.
      When finished you’ll have something like this.
      
5. Click the Create button.
6. In the resulting dialog, click the link to open the dashboard in the Splunk Dashboard Editor.
   

We now leave our app and are using the core Splunk product directly.

Rearrange the dashboard, also fix formatting

We’ll now rearrange our dash board to suit our needs better, and fix some formatting gaffs while we’re at it.

This section is arranged into a few subsections so you can refer to those parts you need.

Change to a different visualization

If you have a table like this:

But want this instead:

Click the Select visualization button in the upper right of that table, and select the line chart visualization. (Or column chart – feel free to try a few on for size!)

Get rid of the ​‘_​time’ label at the bottom

If you think this little label ​‘_​time’ is not necessary:

You can remove it from the x‑axis label by clicking the Format visualization button, clicking on the X‑Axis option, then changing the Title to none.

Move the legend to somewhere else

If you’d like to move the legend:

You can do so by clicking the Format visualization button, clicking on the Legend option, then changing the Legend Position to some other option.

Rearrange the graphs

To move the charts and graphs around, just grab the bop of the bar for each (the ::::: part) and drag it into a new position. It’ll try to snap to various locations, so just keep moving it around in the right area until the little ghost shape is in the right place, then let go.

When you have everything where you want it and looking like you think it should, click the big green Save button in the upper right.

Checking Permissions

By default, Splunk creates new dashboards with permissions only for the owner.

Typically, you’ll want to change this to being shared in ​“App”, so anyone who has a valid login to Splunk and who can run/​open the Cisco CDR app will be able to see your dashboard.

Easily changed!

1. In the upper right, click the three-dots … settings button.
2. Click Edit Permissions
   
3. And all you should have to do is click App in the middle and Save it.
   (Usually there’s no need to change the more granular permissions, but if your Splunk folks tell you differently, do what they say)
   

Now everyone who can log into and see the Cisco CDR Reporting and Analytics app can see this dashboard too.

Schedule a PDF to be emailed

Mary needs those charts every day. No one knows why, but since she’s the boss, … fine.

You have enabled and configured email on your server, haven’t you? If you aren’t sure, check your settings against how Splunk says to set it up.

1. In the upper right of the dashboard, click Export
2. Ignore the first option here, which just generates a PDF that you can save or email manually. Well I mean you can do that if you want, but if you do you are on your own.
3. Instead click the second option to Schedule PDF Delivery.
   
4. Then click the little button to Schedule PDF, fill out the details, and … enjoy!
   

Add a Time picker

Note that this option will remove your ability to schedule PDFs! As a workaround, you can Edit the existing dashboard, and then click Save As to save it as a new dashboard. If it were me, I’d put ​“interactive” in the name somewhere.

First task, convert all graphs/​charts to ​“inline”

NOT NECESSARY ON VERSION 6.1 AND NEWER. So if you don’t see the option to convert it to inline, don’t worry about it!

This change the charts from being based on the saved report, to being just local Splunk searches.

For each search on the page,

1. Click the View report button
2. Then click the option to convert it to inline.
   
3. Answer the little warning message.

Add a time picker

1. Up at the top, click on Add Input
2. The click on Time
   
3. Click on the pencil/​edit button for the new Time input, and
   1. Check the option to Search on change
   2. Rename the token to time_​tok
      
4. (You can also change some other things, like the default time frame here too.)
5. Click Apply

Make that time picker control the times of the charts on the page

Now let’s connect them all together!

For each chart on the page,

1. Click the Edit search button
   
2. In the resulting dialog, change the Time Range to Shared Time Picker (time_​tok)
   
3. Save that,

Then Save the entire page.

Now there’s a bug in Splunk and you have to refresh the entire page in your browser. just press F5, or click the little browser refresh button. The page will work properly after though.

Conclusion

These are not the last words we’ll write on this subject, so stay tuned.

In the meantime if you want to play around with more dashboards in the general sense, I suggest starting with the Splunk Search Tutorial. That link dumps you right into the dashboard section – you will probably want to click over onto the start of it and follow it to get the sample data in first, of course.