7.4 Creating Dashboards and Adding Reports

7.4 Creating Dashboards and Adding Reports

Objectives 6.5 and 6.6 complete the “publish” half of Domain 6.0: create a dashboard, then add a report so the dashboard shows live panels. Reports answer one question; dashboards assemble several answers on one screen for monitoring and handoffs.

What a Dashboard Is (User Definition)

A dashboard is a page made of panels. Each panel typically shows:

• A title
• A visualization or table
• A search—either an inline search typed for that panel or a report the panel references

For User exam scenarios, the happy path is often: build/save reports → create dashboard → add those reports as panels.

Creating a Dashboard (Objective 6.5)

Common creation paths:

Path A — Save a search as a dashboard panel (creates dashboard if needed)

1. Run a polished search (often already visualization-ready).
2. Choose Save As → Dashboard Panel (wording may vary).
3. Select New dashboard (or an existing one).
4. Enter dashboard Title, optional Description, and Permissions.
5. Enter the Panel title.
6. Save—Splunk creates the dashboard with your first panel.

Path B — Create from the Dashboards listing

1. Open Dashboards.
2. Create a new dashboard.
3. Set title/description/permissions.
4. Add panels afterward (from reports or new searches).

Default User roles typically create private dashboards; sharing may require additional capabilities depending on the deployment. Exam takeaway: dashboards, like reports, are not globally public unless shared.

Worked example: first dashboard

You already saved Top 10 HTTP Status Codes (table) and HTTP 500 Errors Over Time (line). Create dashboard Web Reliability — Last 24 Hours (Private while drafting). Add the first panel during creation from the timechart search, or create an empty dashboard and add both reports next.

Adding a Report to a Dashboard (Objective 6.6)

Once a dashboard exists, add panels from saved reports:

1. Open the dashboard → Edit.
2. Choose Add Panel / Add Report (UI labels vary by version).
3. Select the existing report.
4. Confirm the panel title (often defaults from the report name).
5. Save the dashboard.

Why add reports (not only inline searches)?

Report-backed panels keep a single source of truth: fix the report’s SPL once, and dashboard panels that reference it stay aligned. That reuse story is central to combining 6.1–6.4 with 6.5–6.6.

Buttercup-style tutorial pattern (mental model)

Splunk’s Search Tutorial pattern matches the exam story:

1. Transforming search (top, stats, …)
2. Optional visualization change (for example Pie)
3. Save as dashboard panel / add to dashboard
4. Later add more report panels to the same dashboard

You do not need the tutorial dataset memorized—remember the workflow sequence.

Classic Simple XML Dashboards (User Basics)

Classic dashboards (Simple XML) are the traditional Splunk Web dashboards. At User level you should know:

• You primarily build them with the UI editor (add panels, drag layout).
• Behind the scenes they are stored as Simple XML source.
• Power users may open Source to edit XML; Core User questions focus on UI create/add behaviors, not writing XML by hand.

Dashboard Studio — Optional Awareness Only

Modern Splunk deployments may also offer Dashboard Studio (JSON-based editor with different layout tools). For Splunk Core Certified User:

• Be aware Studio exists as another dashboard experience.
• Do not study Studio tokens, dynamic drilldowns, or advanced layout architecture for this blueprint domain.
• If a question asks to create a basic dashboard and add a report, Classic create/add workflows are the intended answer path unless the stem explicitly names Studio in a superficial way.

Author overreach in older materials often dumped Studio/token depth into User prep—skip that here.

Permissions Interaction: Reports + Dashboards

A dashboard panel backed by a report only helps viewers who can:

1. Open the dashboard, and
2. Access the underlying report/search data according to permissions and role capabilities.

If coworkers see the dashboard but panels fail or reports are missing, check report sharing and dashboard sharing, not CIM.

Exam Traps for 6.5 and 6.6

Put It Together

End-to-end User story for Domain 6 so far:

1. Write transforming SPL → table or chart (6.3/6.4)
2. Save As Report; set permissions (6.1/6.2)
3. Create dashboard (6.5)
4. Add report panels (6.6)
5. Edit layout/panels as needed (6.7 next)

That sequence is the Domain 6.0 spine.