Splunk Inc.

09/26/2022 | News release | Distributed by Public on 09/26/2022 15:39

Dashboard Studio: It's the Little Things

Share:
By Lizzy Li September 26, 2022

It's always interesting to hear what feature requests dashboard users share with our product team. Sometimes it's big things - such as being able to set tokens on drilldowns - and sometimes it's little things. In Splunk Cloud Platform 9.0.2208, we've included a handful of Dashboard Studio "little things" updates:

  • Visualization updates
    1. Font size control for Tables and Markdown
    2. Adjustable table column widths
    3. Improved status messages and placeholder images
    4. Map enhancements
  • Additional metadata support for search-based tokens
  • Ability to edit permissions while viewing a Studio dashboard
  • Enhanced security by informing users before leaving a Splunk dashboard

Visualization Updates

The first update that I'm happy to announce is that you can now control font size in Table and Markdown visualizations. This has been one of the top requests this year, and we're excited to finally ship it.

In the configuration panel, look for the "Font Size" option, and adjust anywhere between Extra Small and Extra Large. For Table visualizations, you can also choose whether you want your font spacing to be proportional or monospaced.

In the example above, you can see that the "sourcetype" column is wider than it needs to be, while the "source" column could use some more space. Now, you can click and drag to adjust table column widths, in both View and Edit modes!

When there is no data to render in a visualization, you will see a placeholder image. Data could fail to render for a number of reasons: the search returned no results, there's something wrong with the SPL, a token value has not been set, and so on. Unfortunately, the image below doesn't provide much help in figuring out what's wrong. Here's an example for Table:

To address this, we've updated the placeholder and status messaging to provide more specific information as to what's happening. We've also refreshed the placeholder image to be more subtle, so it's less of a distraction in your dashboard.

In the above example, no search results were returned.

In the above example, there is a problem with the SPL query.

In the above example, the token $sourcetype$ needs to be set before running the query.

In Splunk Cloud Platform 8.2.2203, we released a new map visualization (splunk.map) that supports Marker and Bubble layers.

Some recent enhancements to the map visualization include:

  • Additional information included in tooltips: latitude, longitude, and for bubble maps, the field/value driving the bubble size
  • For bubble maps, new UI is available to select which field to use for bubble size
  • Map position/zoom is saved when modified in Edit mode

Additional Metadata Support in Search-based Tokens

In Splunk Cloud Platform 8.2.2203, we released the ability to reference search results or job metadata as token values. Let's first have a refresher of how it works. In SimpleXML, to use a search result or search job metadata as a token, you start by adding some parameters in the source code. 

index=_internal |  top sourcetype-60mnow$job.resultCount$

In this example, the token "sourcetype_count" is being set as the result count from this search. Now you can leverage this token throughout our dashboard.

In Dashboard Studio, there's no digging around in source. You can directly reference a search's result or metadata as a token. For example, if you have a search named "Top Sourcetypes", you can immediately use $Top Sourcetypes:job.lastUpdated$ as a token throughout your dashboard.

In 9.0.2205, we added the following pieces of metadata:

  • job.sid
  • job.percentComplete
  • job.lastUpdated
  • job.isRealTimeSearch

Edit Dashboard Studio Permissions

Dashboard Studio follows the same permissioning model as Classic (SimpleXML) dashboards, but you previously could only adjust the permissions from the listing page. In Splunk Cloud Platform 9.0.2208, you can now edit permissions while viewing a dashboard, from the Actions dropdown.

Improving Security: Informing Users Before Leaving Splunk

Oftentimes, your workflows span multiple tools outside of Splunk. Your dashboard may have links to internal documentation or other apps. To ensure that you and your users are aware of anytime you're leaving Splunk, we'll now be showing you a modal to acknowledge that action.

This gives you the chance to confirm you intended to navigate away from the dashboard, or to cancel in order to stay on the dashboard.

Coming Soon

Check out Dashboard Studio and send in your feedback through Splunk Ideas, and you might see your feature request listed on a future blog's "coming soon" list! We are continuing to work on new capabilities, which are delivered incrementally with Splunk Cloud Platform and Splunk Enterprise releases.

  • Conditional show/hide of dashboard panels
  • Dashboard tabs
  • Additional UI for all visualizations options
  • Trellis!
  • More drilldown options

Helpful Resources

* This information is subject to change at any time, at the sole discretion of Splunk Inc. and without notice. This roadmap information shall not be incorporated into any contract or other commitment. Splunk undertakes no obligation to either develop or deliver any product, features, or functionality described here.