Splunk Inc.

11/13/2024 | News release | Distributed by Public on 11/14/2024 05:56

Dashboard Studio: New Version Loading

In Splunk Cloud Platform 9.3.2408, there are so many new Dashboard Studio features that we'll skip the intro and dive right in to learn about each:

  • Dashboard version history
  • Auto collapsing the Splunk and App bars
  • Performance improvements for rendering large amounts of numerical or time series data
  • Time range filtering on charts
  • Splunk Observability Cloud metrics integration
  • Alignment options for single value and table visualizations
  • Add saved searches from within Dashboard Studio
  • A collection of enhancements for tabbed dashboards

Version History

Customers have long been asking for source control, as evidenced by the upvotes on this Splunk Idea and the fact it's Idea #7. As a first step, we're excited to provide version history for Dashboard Studio.

Going forward, a new version will be created every time you save a Studio dashboard. You can optionally add a comment when you save changes. You can view a dashboard's version history from the dashboard's Action menu or from the Edit menu on the listing page. You'll be able to filter and sort through recent versions and see who created what versions and when.

You can select one or two versions to view the corresponding dashboard definition(s). If you select two versions, you can compare them in a unified or split view. You can then opt to revert your dashboard to a previous version.

There are a few limitations to be aware of in this initial release, which you can read more about in our documentation.

Auto Collapsing Splunk and App Bars

It's now possible to maximize screen real estate for displaying dashboards by collapsing the Splunk and App bars, which is the second highest upvoted Splunk Idea for Dashboard Studio. A new option is now available under View mode options called "Collapse navigation". When toggled on, the Splunk bar, App bar, and dashboard menu will be collapsed by default.

Users can bring back the Splunk and App bars by re-expanding the dashboard menu, and selecting "Show navigation" from the Display menu. This display option is now always available in View mode, so that you can temporarily collapse the menu any time without having to toggle the default behavior.

Performance Improvements

There has been a trend over the past few years where dashboards are configured to display more charts and more data per chart than before, which can result in some performance impacts. Here's a dashboard in Splunk Cloud Platform 9.2.2406 with 1.8 million data points, which takes about a minute to load.

Here's the same dashboard in Splunk Cloud Platform 9.3.2408, which takes about 15 seconds to load.

For an additional boost, we've defaulted all dashboards to "Optimize rendering" which you can toggle on or off under "View options". This displays a downsampled version of your search results. To increase granularity, you can zoom into a dashboard to redraw data points. You can optionally turn off this optimization for the entire deployment with the activate_downsampling flag in web-features.conf. With "Optimize rendering" turned on, the same dashboard renders in 8 seconds:

Time Range Filtering on Charts

When you're investigating data in your dashboards, you may find that you want to "zoom in" on a particular time range, to get more granular data points across your dashboard (as described in this Splunk Idea). Previously, if you "zoomed in", it would only do a visual zoom - you wouldn't get any new or more granular data points.

Starting in Splunk Cloud 9.3.2408, you can configure a new interaction to "Set time range" on time series charts and specify what time range tokens you want to update. In the following example, all the charts are using the Global Time Range, so you will see all the charts and the time input update when zoomed in.

Splunk Observability Cloud Metrics Integration

For Splunk Cloud Platform and Splunk Observability Cloud customers, you can begin to see your data in a single pane of glass with the integration of real time metrics in Dashboard Studio.

Dashboard Studio now supports a new data source for Splunk Observability Cloud metrics. You can search for a specific metric name and apply analytics and filters. For more complicated configurations, you can set up your chart in Splunk Observability Cloud, then copy and paste the chart URL into the import side panel. This provides users with the flexibility to have SPL based charts alongside metric based charts powered by Splunk Observability Cloud.

Creating a Simple Metric Chart

For creating a new Splunk Observability Cloud powered chart in Dashboard Studio, you first create a data source using the new "Splunk Observability Cloud metric search" source. You can type in a metric name, browse related fields for filtering your metric time series, and choose analytics to represent your data. Once your data source is saved, you can now add it to a visualization.

Importing a Created Chart From Splunk Observability Cloud

If you are interested in creating a more complex chart with potentially multiple metrics, you can go to Splunk Observability Cloud from Dashboard Studio using the new "Import Content" icon. From Splunk Observability Cloud, you can create a chart and copy the URL to paste back into the dashboard. After pasting, the chart is deconstructed into a data source and visualization, and when you click "Import", the chart is now added to your dashboard.

Importing a Pre-Built Navigator Into Dashboard Studio

If you like some of the Navigators and out of the box content in Splunk Observability Cloud, you can navigate to the chart of your choice, click "Share", and copy the link. Going to Dashboard Studio, you can click on the "Import Content" icon, paste the link, click "Import" and then the chart is recreated in your dashboard to live alongside existing SPL based charts.

To learn more about what's supported or how to enable Splunk Cloud Observability metrics integration, check out the documentation. To provide feedback to the product team, sign up for our feedback program.

Alignment Options for Single Value and Table Visualizations

One of the things that customers tell us they love about Dashboard Studio is how easy it is to customize dashboards to look a particular way. We're making that even easier now by introducing the ability to apply alignment for single value and table visualizations.

For single values, you can select whether to align the major value left, right or center. For tables, you can set a default at the table level or specify different alignment options per column, per header and cells. You can now also turn on text wrapping per column!

Add Saved Searches From Within Dashboard Studio

You can now browse and add saved searches from within Dashboard Studio from the data source overview panel, selecting Create saved search, and browsing saved searches. Once you select a saved search, you can preview its SPL, time range, and other metadata to verify it's the right one.

Tabbed Dashboards Enhancements

Now that all dashboards support tabs, we added a number of enhancements to make managing tabs easier. You can now easily move a visualization between tabs:

You can also set up an on-click interaction to switch to another tab in the dashboard:

When linking to a dashboard, you can choose which tab to land on by specifying the tab ID in the URL, with the following format: app//?tab=.

Coming Soon

Check out Dashboard Studio and send in your feedback through Splunk Ideas, and you might see your feature request listed on a future blog's "coming soon" list! We are continuing to work on new capabilities, which are delivered incrementally with Splunk Cloud Platform and Splunk Enterprise releases.

Next up…

  • View dashboards without logging in
  • Button input
  • Conversion improvements

Helpful Resources

* This information is subject to change at any time, at the sole discretion of Splunk Inc. and without notice. This roadmap information shall not be incorporated into any contract or other commitment. Splunk undertakes no obligation to either develop or deliver any product, features, or functionality described here.