7.4 Creating Dashboards and Adding Reports

Splunk Core Certified User Study Guide Exam

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts & Logistics 1.2 Study Strategy & Learning Path

2 Splunk Basics

2.1 Splunk Components 2.2 Uses of Splunk 2.3 Splunk Apps 2.4 User Settings & Basic Navigation

3 Basic Searching

3.1 Running Basic Searches 3.2 Setting Time Ranges 3.3 Contents of Search Results 3.4 Refining Searches 3.5 Using the Timeline 3.6 Working with Events 3.7 Controlling Search Jobs 3.8 Saving Search Results

4 Using Fields in Searches

4.1 Understanding Fields 4.2 Using Fields in Searches 4.3 The Fields Sidebar

5 Search Language Fundamentals

5.1 Basic Search Commands & Practices 5.2 The Search Pipeline 5.3 Specifying Indexes in Searches 5.4 table, rename, fields, dedup, and sort

6 Using Basic Transforming Commands

6.1 The top Command 6.2 The rare Command 6.3 The stats Command

7 Creating Reports and Dashboards

7.1 Saving and Editing Reports 7.2 Statistical Table Reports 7.3 Chart Visualization Reports 7.4 Creating Dashboards and Adding Reports 7.5 Editing Dashboards

8 Creating and Using Lookups

8.1 Lookup Concepts and File Examples 8.2 Creating Lookup Files and Definitions 8.3 Configuring Automatic Lookups 8.4 Using Lookups in Searches

9 Creating Scheduled Reports and Alerts

9.1 Scheduled Reports 9.2 Describing and Creating Alerts 9.3 Viewing Fired Alerts

7.4 Creating Dashboards and Adding Reports

Key Takeaways Explain This Topic AI

A dashboard groups one or more panels so related reports and visualizations can be monitored together in one view.

You can create a new dashboard from Search (Save As Dashboard Panel) or from the Dashboards listing, choosing Private or Shared in App permissions.

Adding a report to a dashboard creates a panel backed by that saved report’s search and visualization.

Classic Simple XML dashboards are the User-level default path for create/add workflows in training and the blueprint.

Dashboard Studio may exist in your environment as an alternate editor—know it exists, but User objectives do not require Studio tokens or drilldown architecture.

Last updated: August 2026

7.4 Creating Dashboards and Adding Reports

Objectives 6.5 and 6.6 complete the “publish” half of Domain 6.0: create a dashboard , then add a report so the dashboard shows live panels. Reports answer one question; dashboards assemble several answers on one screen for monitoring and handoffs.

What a Dashboard Is (User Definition)

A dashboard is a page made of panels . Each panel typically shows:

A title
A visualization or table
A search—either an inline search typed for that panel or a report the panel references

Concept Meaning
Dashboard The overall page/layout
Panel One visual block on the page
Report-backed panel Panel that uses a saved report’s search/viz
Inline panel search Search stored on the panel itself (not a separate report)

For User exam scenarios, the happy path is often: build/save reports → create dashboard → add those reports as panels.

Creating a Dashboard (Objective 6.5)

Common creation paths:

Path A — Save a search as a dashboard panel (creates dashboard if needed)

Run a polished search (often already visualization-ready).

Choose Save As → Dashboard Panel (wording may vary).

Select New dashboard (or an existing one).

Enter dashboard Title , optional Description , and Permissions .

Enter the Panel title .

Save—Splunk creates the dashboard with your first panel.

Path B — Create from the Dashboards listing

Open Dashboards .

Create a new dashboard.

Set title/description/permissions.

Add panels afterward (from reports or new searches).

Permission option Effect
Private Only you can view/edit
Shared in App Visible to others in that app (subject to their capabilities)

Default User roles typically create private dashboards; sharing may require additional capabilities depending on the deployment. Exam takeaway: dashboards, like reports, are not globally public unless shared.

Worked example: first dashboard

You already saved Top 10 HTTP Status Codes (table) and HTTP 500 Errors Over Time (line). Create dashboard Web Reliability — Last 24 Hours (Private while drafting). Add the first panel during creation from the timechart search, or create an empty dashboard and add both reports next.

Adding a Report to a Dashboard (Objective 6.6)

Once a dashboard exists, add panels from saved reports:

Open the dashboard → Edit .

Choose Add Panel / Add Report (UI labels vary by version).

Select the existing report.

Confirm the panel title (often defaults from the report name).

Save the dashboard.

Source for panel Pros Watch-outs

Existing report Reuses known good SPL/viz; one edit to the report can update its panels Report permissions must allow viewers to use it

New panel from search Fast for one-off panels Harder to reuse elsewhere unless you convert/save as report
Clone panel from another dashboard Speeds layout reuse Still verify time ranges and titles

Why add reports (not only inline searches)?

Report-backed panels keep a single source of truth: fix the report’s SPL once, and dashboard panels that reference it stay aligned. That reuse story is central to combining 6.1–6.4 with 6.5–6.6.

Buttercup-style tutorial pattern (mental model)

Splunk’s Search Tutorial pattern matches the exam story:

Transforming search ( top , stats , …)
Optional visualization change (for example Pie)
Save as dashboard panel / add to dashboard
Later add more report panels to the same dashboard

You do not need the tutorial dataset memorized—remember the workflow sequence .

Classic Simple XML Dashboards (User Basics)

Classic dashboards (Simple XML) are the traditional Splunk Web dashboards. At User level you should know:

You primarily build them with the UI editor (add panels, drag layout).

Behind the scenes they are stored as Simple XML source.

Power users may open Source to edit XML; Core User questions focus on UI create/add behaviors, not writing XML by hand.

Classic dashboard idea User-level expectation
UI editor vs Source editor Use UI to create/add panels; Source exists but is not the User focus
Panels reference reports or inline searches Prefer reports for reusable analytics
Permissions Private / App Same sharing model family as reports
Dashboard Studio — Optional Awareness Only

Modern Splunk deployments may also offer Dashboard Studio (JSON-based editor with different layout tools). For Splunk Core Certified User :

Be aware Studio exists as another dashboard experience.

Do not study Studio tokens , dynamic drilldowns, or advanced layout architecture for this blueprint domain.

If a question asks to create a basic dashboard and add a report, Classic create/add workflows are the intended answer path unless the stem explicitly names Studio in a superficial way.

Author overreach in older materials often dumped Studio/token depth into User prep—skip that here.

Permissions Interaction: Reports + Dashboards

A dashboard panel backed by a report only helps viewers who can:

Open the dashboard, and

Access the underlying report/search data according to permissions and role capabilities.

If coworkers see the dashboard but panels fail or reports are missing, check report sharing and dashboard sharing , not CIM.

Exam Traps for 6.5 and 6.6

Trap Reality
Thinking a report automatically appears on a dashboard You must create/add the panel
Confusing Save As Report with Save As Dashboard Panel Related but distinct save targets
Requiring Studio tokens to “create a dashboard” User create/add works in Classic UI
Assuming Private dashboards are visible to the whole app Private means owner-only until shared
Building knowledge objects (tags/macros) instead of panels Out of scope for these objectives
Put It Together

End-to-end User story for Domain 6 so far:

Write transforming SPL → table or chart (6.3/6.4)
Save As Report; set permissions (6.1/6.2)
Create dashboard (6.5)
Add report panels (6.6)
Edit layout/panels as needed (6.7 next)

That sequence is the Domain 6.0 spine.