Simple explanation
This lesson covers choosing the right visual format for a panel, and controlling who can see or edit dashboards and reports once built.
Technical explanation
Common visualization types: single value (one big number, good for a KPI-style metric), line chart (trends over time, especially good with 3+ series per Splunk's own guidance), column/bar chart (comparing discrete categories), pie chart (proportions of a whole, best with a small number of categories), area chart, and tables (raw or aggregated data in rows/columns, when a chart isn't the right fit).
Choosing appropriately: a single value works well for "is this metric currently OK," a line/timechart-based visualization works well for trends, and a table remains appropriate whenever precise individual values matter more than a visual pattern.
Sharing and permissions:
- Private — visible only to the creator.
- This app only — visible to users of the specific app the object lives in.
- All apps (global) — visible organization-wide, regardless of app context.
- Edit permissions — separate from VIEW permissions; a user might be able to view a dashboard without being able to modify it, and the owner controls this distinction explicitly via the Edit dropdown/permissions settings.
- Dashboard/report ownership transfer — in some configurations, ownership itself can be reassigned, useful when the original creator leaves the organization but the object needs to remain maintained by someone else going forward.
Synonyms / related terms
| Term | Means | |---|---| | KPI | Key Performance Indicator, often displayed as a single-value panel | | Global sharing | Visible across all apps, organization-wide |
Concept Check
"A dashboard panel showing a distribution across 12 different categories is displayed as a pie chart, and viewers find it genuinely difficult to distinguish or compare the smaller slices." A pie chart with 12 categories is a poor visualization choice for this data shape — pie charts work best with a SMALL number of categories where proportional comparison is intuitive; a bar/column chart would better handle 12 categories, letting viewers compare heights precisely rather than squinting at similarly-sized thin slices.
Interview-style Q&A
Q: Why separate view permissions from edit permissions rather than treating access as all-or-nothing? A: "Most consumers of a dashboard just need to see current status — they have no need (and shouldn't have the ability) to modify the underlying search logic or layout, since an accidental or unauthorized change could break the dashboard for everyone else relying on it. Separating view from edit lets an organization share information broadly and safely, while still keeping change control tight and limited to the people actually responsible for maintaining that object."
Memory trick
"Value shows One number, Line shows a Trend, Bar shows a Comparison, Pie shows a Portion" — four common visualization types, each tied to the one-word question it answers best.