Hi, I have a dashboard, this contains several panels. When do u use a panel and when do you choose for a report. There is a lot of information on the internet but I can't find an answer that really explains this for me.
Ok it makes sense now. You want to compare Reports
with Prebuilt Panel
.
Just to begin they are completely different. While both of them are saved templates that can be reused in Dashboards, Reports are based on Search
(conf file mentioned in previous comment) and Pre-Built Panels like its name suggests is an XML snippet containing
as the root node
i.e. :
<panel>
...
...
</panel>
Hence Pre-built Panels can have many features of Simple XML Dashboard which reports do not have. Following are few to name:
<html>
<input>
<style>
overridePlease refer to one of my recent answers to use a Prebuilt Panel
to create our own custom multi-level Dropdown Menu instead of Splunk's default menu. I am sure such things can only be achieved by Prebuilt Panels and not Reports.
Just to expand a little.
if scheduling a Report to run, you can include multiple things like a link to the report/results, the search string, inline results, the csv or a pdf. If just trying to export the results of a Report, you have the options of PDF, CSV, JSON and XML.
a dashboard, however, built with or without reports/prebuilt panels, can only be exported as a PDF. The individual panels have the options to be exported as CSV, JSON and XML, however.
but a panel and a pre-built panel are also based on a search?? How would it otherwise get the results?
Strange thing is that besides a report and a pre-built panel you also reuse a (normal) panel, by 'clone from dashboard' . It seems to me that the use of report has really no benefits.
@Mike6960, seems like you want to know the purpose of various options to quickly create panels in a Dashboard. So for whatever reason you have some existing components like prebuilt panel or report or another dashboard with same/similar panel, Splunk gives you flexibility to re-use those at your finger tips. You are not supposed to use all of them, or may use one more often than the other.
panel and a pre-built panel are also based on a search? How would it otherwise get the results?
- Yes, and pre-built panels are just templates. The moment you save it as pre-built panel (based on permission) it may be available in any dashboard within app or global reference. Think of pre-built panel as macro or function in programming where you can
1) Re-use same kind of behavior across your app based on how flexible your template is
2) Avoid re-writing same code
3) Easy maintenance from Single place (reference of pre-built panel is added not the entire code)
I have already given one use case for pre-built panel with Custom Navigation in all Splunk dashboards within App. We also had another use case for Pre-built panel where customer wanted unified look in all Dashboards by having a Trellis with six Single Value visualizations in the first row, which could represent Orders or Customer or Items but a snapshot of the same should always be the first row. For me it was a perfect candidate for Pre-Built Panel, which would show Six Single Values and the token to query would change based on the Dashboard.
...you also reuse a (normal) panel, by 'clone from dashboard'
- When you clone a panel from a dashboard you are creating a duplicate copy of the same code (you don't have to write the code, but you need to maintain consistency in different dashboards)
use of report has really no benefits
- I think I had already called out previous answer in the same thread and also points from @cmerriman.
- You can embed a report to external page but not dashboard.
- If you already have a report which does the work you are interested in (for whatever need it was created for), you can use the same to create a panel in Dashboard.
I am not sure whether it clarifies stuff for you or make things more murky 🙂
Splunk Report
savedsearches.conf
configuration file in Splunk. Splunk Dahsboard
<dashboard>
and not <form>
. Also Custom Visualization/Trellis, post processing search and several features are not supported for Scheduled PDF delivery.Please let us know if there are other differences that you are interested in and we can provide further details.
Hi niketnilay , I cant see the benefits of using a report over a dashboardpanel... Is it true that i cant see the difference between a report and a panel when I view them both in a dashboard only when I choose for 'edit'?
"A report in Splunk is essentially a single Search query that runs to produce a single visualization" , isn't this not also the case for a panel?
maybe I am just confused, but it looks like reports-panel-prebuilt panels are more or less the same
You use a report when you are sharing a search across several dashboards/panels so that if the search must change, you only need to change it in a single place, instead of inside of every panel.
Thanks, but this is also possible with a panel? (clone from dashboard)