Dashboard Wizardry:
Transcript of Dashboard Wizardry:
![Page 1: Dashboard Wizardry:](https://reader035.fdocuments.us/reader035/viewer/2022081722/58a1a5791a28abb24d8c4408/html5/thumbnails/1.jpg)
Copyright © 2016 Splunk Inc.
Nicholas Filippi -‐ Product Management, Splunk
Siegfried Puchbauer -‐ Core Engineering, Splunk
Dashboard Wizardry: Advanced Dashboard Interac1vity
![Page 2: Dashboard Wizardry:](https://reader035.fdocuments.us/reader035/viewer/2022081722/58a1a5791a28abb24d8c4408/html5/thumbnails/2.jpg)
Disclaimer
2
During the course of this presentaJon, we may make forward looking statements regarding future events or the expected performance of the company. We cauJon you that such statements reflect our current expectaJons and esJmates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward-‐looking statements, please review our filings with the SEC. The forward-‐looking statements made in the this presentaJon are being made as of the Jme and date of its live presentaJon. If reviewed aRer its live presentaJon, this presentaJon may not contain current or
accurate informaJon. We do not assume any obligaJon to update any forward looking statements we may make. In addiJon, any informaJon about our roadmap outlines our general product direcJon and is
subject to change at any Jme without noJce. It is for informaJonal purposes only and shall not, be incorporated into any contract or other commitment. Splunk undertakes no obligaJon either to develop the features or funcJonality described or to include any such feature or funcJonality in a future release.
![Page 3: Dashboard Wizardry:](https://reader035.fdocuments.us/reader035/viewer/2022081722/58a1a5791a28abb24d8c4408/html5/thumbnails/3.jpg)
Brought to You By…
Siegfried Puchbauer • Lead Engineer, Dashboard Team • Expert in Dashboards, AlerJng, Javascript,
and Bowler Hats
Nicholas Filippi • Product Management, Splunk • Responsible for Dashboards & Info Delivery
![Page 4: Dashboard Wizardry:](https://reader035.fdocuments.us/reader035/viewer/2022081722/58a1a5791a28abb24d8c4408/html5/thumbnails/4.jpg)
You are Here Because…
4
• Interested in Building More InteracJve Dashboards
• Don’t Want to Use Custom Javascript or Stylesheets • (but familiar with Simple XML)
![Page 5: Dashboard Wizardry:](https://reader035.fdocuments.us/reader035/viewer/2022081722/58a1a5791a28abb24d8c4408/html5/thumbnails/5.jpg)
Agenda
Background Live Example – Tokens – Event Handlers – Show/Hide content – Search Events
What’s new in Splunk 6.5 Wrap-‐Up
5
![Page 6: Dashboard Wizardry:](https://reader035.fdocuments.us/reader035/viewer/2022081722/58a1a5791a28abb24d8c4408/html5/thumbnails/6.jpg)
What Is A Dashboard? Enterprise Security MINT IT Service Intelligence
Prem
ium SoluJ
ons
Sample App eCars Project Stadium Project
Internal Examples
![Page 7: Dashboard Wizardry:](https://reader035.fdocuments.us/reader035/viewer/2022081722/58a1a5791a28abb24d8c4408/html5/thumbnails/7.jpg)
Dashboard Stack
Drag-‐and-‐Drop UI Editor
Simple XML
SplunkJS
CoreJS
CSS/JS Extensions
Public API
Private API
UI Framework / SplunkD
HTML
Capa
bility / Co
mplexity
![Page 8: Dashboard Wizardry:](https://reader035.fdocuments.us/reader035/viewer/2022081722/58a1a5791a28abb24d8c4408/html5/thumbnails/8.jpg)
Anatomy of a Dashboard
8
Title
Form Inputs (fieldset / inputs)
Row
Panel Panel
Element Element
Element
<form> <label>My Dashboard</label> <fieldset> <input> <!– form inputs --> </input> </fieldset> <row> <panel> <chart> <!– ... --> </chart> <table> <!– ... --> </table> </panel> </row> </form>
![Page 9: Dashboard Wizardry:](https://reader035.fdocuments.us/reader035/viewer/2022081722/58a1a5791a28abb24d8c4408/html5/thumbnails/9.jpg)
Dashboard Fundamentals Layout Search Managers Event Handlers Form Inputs Display Controls VisualizaEons Extensions
• row • panel • element
• search • ref (report) • base (Post-‐
process) • cache • refresh** • refreshType**
• input • change • search • drilldown • selecJon • init**
• text • radio • dropdown • checkbox • mulJselect • link • Jme
• depends • rejects
• Events • Table • Line • Area • Column • Bar • Pie • Scaier • Bubble • Single Value • Radial Gauge • Filler Gauge • Marker Gauge • Map • Choropleth Map
• script (JS) • stylesheet (CSS) • dashboard.js • dashboard.css
** New in Splunk Enterprise 6.5
Token Management
9
![Page 10: Dashboard Wizardry:](https://reader035.fdocuments.us/reader035/viewer/2022081722/58a1a5791a28abb24d8c4408/html5/thumbnails/10.jpg)
Let’s Build Some Dashboards!
10
![Page 11: Dashboard Wizardry:](https://reader035.fdocuments.us/reader035/viewer/2022081722/58a1a5791a28abb24d8c4408/html5/thumbnails/11.jpg)
The Data: Track Day
• Sonoma Raceways – 1 Day – 28 Splunkers – 30 Cars
• Data via – ODB II Dongle -‐> Cloud Service -‐> Modular Input – LocaJon data & metrics (speed, rpm, etc)
11
![Page 12: Dashboard Wizardry:](https://reader035.fdocuments.us/reader035/viewer/2022081722/58a1a5791a28abb24d8c4408/html5/thumbnails/12.jpg)
The Data: Track Day
12
![Page 13: Dashboard Wizardry:](https://reader035.fdocuments.us/reader035/viewer/2022081722/58a1a5791a28abb24d8c4408/html5/thumbnails/13.jpg)
Building Dashboards Part I
13
![Page 14: Dashboard Wizardry:](https://reader035.fdocuments.us/reader035/viewer/2022081722/58a1a5791a28abb24d8c4408/html5/thumbnails/14.jpg)
Tokens
14
• AutomaJc data binding • Variables – connecJng components and interacJons • Use in UI or XML
![Page 15: Dashboard Wizardry:](https://reader035.fdocuments.us/reader035/viewer/2022081722/58a1a5791a28abb24d8c4408/html5/thumbnails/15.jpg)
Token Filters
• Insert altered/processed value • Built-‐in – $token|s$ -‐ search escape – $token|u$ -‐ URL encode – $token|h$ -‐ HTML escape – $token|n$ -‐ No encoding (New in Splunk 6.5)
• Build your own (in Javascript) – $token|myfilter$
15
![Page 16: Dashboard Wizardry:](https://reader035.fdocuments.us/reader035/viewer/2022081722/58a1a5791a28abb24d8c4408/html5/thumbnails/16.jpg)
Form Input Values and Token Namespaces • Token Namespaces
– default – current values of form input fields
– submiFed – submiied values of fields
– url – submiied form.* tokens persisted
Refer to namespaces: $submitted:driver$ !
16
• $form.mytoken$ !tokens contain raw form input
• $mytoken$ !aRer applying prefix, suffix, default value
![Page 17: Dashboard Wizardry:](https://reader035.fdocuments.us/reader035/viewer/2022081722/58a1a5791a28abb24d8c4408/html5/thumbnails/17.jpg)
Building Dashboards Part II
17
![Page 18: Dashboard Wizardry:](https://reader035.fdocuments.us/reader035/viewer/2022081722/58a1a5791a28abb24d8c4408/html5/thumbnails/18.jpg)
Event Handlers • Introduce behaviors based on event hooks
ê User iniJated events, or search job events
• Types ê Drilldown/condiJon – user clicks on a cell, or bar on a chart ê input / change – user selects a value on a form input ê selecJon – for line/column/area, user selects a window to zoom into ê search – events come back from a search job (progress, done, error) ê init – iniJal page load; use this to set page tokens
• Configure Behaviors ê Set tokens ê Unset tokens ê Link to another page or search ê Evaluate new tokens
18
![Page 19: Dashboard Wizardry:](https://reader035.fdocuments.us/reader035/viewer/2022081722/58a1a5791a28abb24d8c4408/html5/thumbnails/19.jpg)
Show and Hide Content
• Control whether you hide or show a given object based on existence of a token
– Contextual (in-‐page) Drilldown – Cascading Form Inputs
• Applies to element, row, panel, input objects • Type
• <table depends=“$show_table$”> !– Hide by default, show when token(s) exist • <table rejects=“$hide_table$”> !– Show by default, hide when token(s) exist
19
![Page 20: Dashboard Wizardry:](https://reader035.fdocuments.us/reader035/viewer/2022081722/58a1a5791a28abb24d8c4408/html5/thumbnails/20.jpg)
Building Dashboards Part III
20
![Page 21: Dashboard Wizardry:](https://reader035.fdocuments.us/reader035/viewer/2022081722/58a1a5791a28abb24d8c4408/html5/thumbnails/21.jpg)
Search & Result Token Seier • Advanced Dashboard Logic • Key Benefits
– Include result count in Jtle – Null search swapper (hide if search returns no results) – Custom HTML element driven by search object
• Run search object anywhere on the page • Set tokens within search based on
– Search metadata (string, earliest/latest) – Job metadata (result count, run Jme) – 1st result
• Eval-‐based condiJon/value support
21
![Page 22: Dashboard Wizardry:](https://reader035.fdocuments.us/reader035/viewer/2022081722/58a1a5791a28abb24d8c4408/html5/thumbnails/22.jpg)
Wrap-‐Up
![Page 23: Dashboard Wizardry:](https://reader035.fdocuments.us/reader035/viewer/2022081722/58a1a5791a28abb24d8c4408/html5/thumbnails/23.jpg)
What’s New in 6.5
Search Refresh & RefreshDisplay IniJal Page Load Controls – <init> event – Global environment variables
Token Filters – For ”No Encoding”, use $token|n$
23
![Page 24: Dashboard Wizardry:](https://reader035.fdocuments.us/reader035/viewer/2022081722/58a1a5791a28abb24d8c4408/html5/thumbnails/24.jpg)
Dashboard Refresh op1mizing the view experience for con1nuous monitoring of insights
• ConJnuous dashboard monitoring – Run refresh searches in the background, then configure how you want the results to surface to the UI
– Seamlessly transiJon new results to the page – Pseudo real-‐Jme behavior
• Technical Details – Configurable refresh indicator
ê (“none” | “progress bar” | “preview and progress bar”)
– Configurable refresh interval/delay schedule – UI editor support (no XML ediJng needed) – Refresh supported within search manager
24
![Page 25: Dashboard Wizardry:](https://reader035.fdocuments.us/reader035/viewer/2022081722/58a1a5791a28abb24d8c4408/html5/thumbnails/25.jpg)
IniJal Page Load Controls Global Variables For Use Throughout the Page – $env:app$ – $env:user$ – $env:user_realname$ – $env:user_email$ – $env:locale$ – $env:page$ – $env:product$ – $env:version$ – $env:instance_type$ – $env:deployment_type$
<init> Event – Set global page variables – Use condiJon logic against global variables
25
<dashboard> <label>Network Monitoring</label> <init> <set token="application">Exchange</set> <eval token="now">strftime(now(),"%m/%d/%y %H:%M:%S")</eval> </init> … </dashboard>
![Page 26: Dashboard Wizardry:](https://reader035.fdocuments.us/reader035/viewer/2022081722/58a1a5791a28abb24d8c4408/html5/thumbnails/26.jpg)
More InformaJon • Splunk 6.x Dashboard Examples
hips://splunkbase.splunk.com/app/1603/
• DocumentaJon
hip://docs.splunk.com/DocumentaJon/Splunk/6.5.0/Viz/PanelreferenceforSimplifiedXML
![Page 27: Dashboard Wizardry:](https://reader035.fdocuments.us/reader035/viewer/2022081722/58a1a5791a28abb24d8c4408/html5/thumbnails/27.jpg)
More InformaJon Demo Code
hips://github.com/splunk/advanced-‐dashboards-‐conf15 Splunk 6.x Dashboard Examples
hips://splunkbase.splunk.com/app/1603/ • DocumentaJon
hip://docs.splunk.com/…/6.3.0/Viz/OverviewofSimplifiedXML
![Page 28: Dashboard Wizardry:](https://reader035.fdocuments.us/reader035/viewer/2022081722/58a1a5791a28abb24d8c4408/html5/thumbnails/28.jpg)
Splunk 6.x Dashboard Examples App • Recipe Book for Dashboards • Updated on Every Release • Examples
– Basic – Chart – Table – Single Value – Map – Search Types – Form Input – Drilldown – Layout – Custom VisualizaJons – Token CustomizaJon
• Tools
28
![Page 29: Dashboard Wizardry:](https://reader035.fdocuments.us/reader035/viewer/2022081722/58a1a5791a28abb24d8c4408/html5/thumbnails/29.jpg)
Come Visit – “Ask the Dashboard Expert”
29
• For assistance with troublesome dashboards • For migraJon Jps • To brag about something cool you built • To ask quesJons • Or, just to say hi!
@Dashboard Clinic
![Page 30: Dashboard Wizardry:](https://reader035.fdocuments.us/reader035/viewer/2022081722/58a1a5791a28abb24d8c4408/html5/thumbnails/30.jpg)
THANK YOU