What if you spend hours building a perfect Splunk dashboard, but it only shows old data and doesn't let anyone else in your team use it? This chapter solves that exact problem — it teaches you how to add interactive elements like clickable charts and search bars so viewers can explore data themselves, and then how to share those live dashboards with colleagues so everyone can stay informed and take action.
Jump to a section
A simple way to picture Dashboard Interactivity and Sharing
Your living room, on a Saturday afternoon. You have a giant new smart home control panel fixed to the wall — a sleek tablet that shows the temperature, lights, security cameras, and music system all in one place.
Right now, the panel only shows a static snapshot of the current temperature. It does not respond to taps. You can't adjust the thermostat from it. You can't dim the lights for a movie. You can't arm the security system before you leave. It is just a pretty picture of a dashboard that does nothing. That’s a dashboard without interactivity — it shows information but lets you do nothing about it.
Now add interactive elements. You tap the thermostat icon, spin a virtual dial, and the real temperature in your house changes. You tap a button that says 'Movie Mode', and the lights dim, the blinds close, and your sound system turns on. You tap 'Away Mode', and the locks engage, the cameras start recording, and the thermostat sets itself to an energy-saving level. This is interactive dashboard — it lets you control your home based on the data you see.
Finally, you want your partner to control the panel from their phone while they're at work. You share access to the panel. Your partner now sees the same live data, same controls, and can adjust the thermostat from the office. That’s sharing a dashboard — giving other people the ability to view and interact with the same live data and controls from their own devices.
After you build a Splunk dashboard that shows the data you need, the next step is making it useful for real work. A static dashboard is like a printed map — it shows one view of the world at one moment. An interactive dashboard is like a GPS app — you can zoom in, search for a specific address, tap on a landmark to get more details, and share your route with a friend. Interactivity and sharing turn a view of data into a tool your whole team can use.
Let's start with interactive elements. Splunk dashboards can include several types of interactive controls that let viewers change what they see. The most common is a dropdown menu. This shows a list of options (like server names or time ranges). When a viewer picks an option from the dropdown, the dashboard updates to show data only for that choice. For example, a dropdown labelled 'Department' might have options: Sales, Marketing, Engineering. Clicking 'Marketing' changes all the charts on the page to show only Marketing's data.
Another interactive element is a radio button. Radio buttons let you choose one option from a small set (like On or Off, Yes or No). They are useful for toggling between modes, such as 'Show All Alerts' vs 'Show Critical Alerts Only'. A checkbox lets you select one or more options independently — you could tick 'Sales' and 'Engineering' at the same time to compare them.
A multiselect dropdown is like a normal dropdown but allows you to pick several items from the list, not just one. It is useful when you want to filter data by multiple values at once, such as showing errors from several specific servers. A time range picker is a special control that lets viewers specify a time period — like Last 24 Hours, Last 7 Days, or a custom date range. This is incredibly useful because different questions need different time windows.
A link or URL token is another interactive element. You can make a chart clickable so that clicking on a bar or a slice of a pie chart opens a new dashboard or a detailed search. This creates a drilldown — you start with a high-level overview and click into a specific area for more details. For example, if you see a bar showing 200 errors from the server 'Web01', clicking that bar could open a new dashboard showing each individual error message from 'Web01'.
Now, how do these interactive elements work behind the scenes? They are powered by tokens. A token is a placeholder that holds a value. When you select an option from a dropdown, the token stores that choice. Then all the charts and searches on the dashboard use that token value to filter their results. If the token value changes (because you clicked a different option), every chart on the dashboard automatically updates to reflect the new data. This is the magic that makes interactive dashboards feel alive and responsive.
To make a chart or table interactive, you set a drilldown action on it. A drilldown can open a search, a dashboard, or a URL. When you click on a data point, Splunk sends the value of that data point as a token to the target dashboard or search. This lets you pass context from one view to the next.
Now for sharing. A dashboard you build is private — only you (the creator) can see it when you are logged into Splunk. To let others see it, you must share it. There are two main ways to share a dashboard in Splunk.
The first way is to share with specific users or roles. You set permissions on the dashboard so that certain users or groups (like 'Engineering Team' or 'Manager Role') can view or edit it. You can grant different levels of access: 'Read' lets them see the dashboard but not change it; 'Write' lets them edit and save changes; 'Full Control' lets them share it further.
The second way is to embed the dashboard as a URL or use a dashboard view. You can generate a direct link to the dashboard that you can share in an email, a chat message, or a team portal. Anyone with the link and the right permissions can access it. You can also set the dashboard to auto-refresh — it will update every 30 seconds, 5 minutes, or whatever interval you choose, so viewers always see the latest data without refreshing the page.
Important: when you share a dashboard, the data the viewer sees depends on their own permissions. If the dashboard pulls data from a source they are not allowed to see (because of permissions set on the data itself), they will see empty charts or error messages. Sharing the dashboard does not bypass security rules. This means you must ensure your viewers have the correct permissions on the underlying data sources as well.
For the SPLK-1002 exam, you need to know which types of interactive elements exist, how tokens work at a basic level, what drilldown does, and the difference between sharing to specific users versus generating a shareable link.
Identify the control type
Decide which interactive element your dashboard needs. If viewers must pick exactly one option (like a department name), use a dropdown. If they need to turn a view on or off (like showing errors only), use a radio button. If they can pick multiple (like several server names), use a multiselect or checkboxes. This choice is the foundation of the interaction.
Add the control to the dashboard
In the Splunk dashboard editor, add a new input element and select the type (dropdown, radio button, etc.). Give it a label that viewers will understand (like 'Select a Server'). Configure the list of options — you can type static values (Server01, Server02) or use a search result to populate the list dynamically.
Create a token for the control
When you configure the control, you define a token name (usually starts with a dollar sign, like $server_token$). This token will store the value the viewer selects. Every time the viewer changes their selection, the token value updates automatically. Think of the token as a bucket that holds the current choice.
Link the token to dashboard panels
Now edit each chart or table on the dashboard to use the token. For example, the base search for a chart might include '| search server=$server_token$' so that the chart only shows data for the selected server. When the token changes, the chart automatically reruns its search with the new value, updating instantly.
Add drilldown to a chart or table
Select a chart or table and enable drilldown. Choose what happens when a viewer clicks on a data point: open a search, navigate to another dashboard, or go to an external URL. Map the clicked data value (like the server name or error count) to a token that the destination will receive. This creates a seamless journey from high-level overview to detailed investigation.
Set permissions for the dashboard
Go to the dashboard settings and find the permissions section. Decide who can see or edit the dashboard. You can share with specific users, roles (like 'Operations Team'), or everyone (public). Grant only the level of access needed — typically Read for viewers, Write for creators or admins. Remember: this does not grant data access.
Test and share the dashboard
Open the dashboard in a different browser or ask a colleague to test it. Make sure the controls work, tokens update properly, and drilldowns open the correct views. Once satisfied, share the direct URL with your team, or embed it in a company portal. Set an auto-refresh interval if live updates are needed, but be aware that filters reset on refresh.
Meet Priya. She is a support analyst at a mid-sized company that runs an e-commerce website. The site went down for 20 minutes yesterday, and the CEO wants to know why. Priya has been building dashboards for a few months, and she knows that a static dashboard showing yesterday's data won't help the operations team fix the current issue.
Priya builds a new dashboard called 'Website Health Overview'. She starts with a table that shows the status (Up or Down) of each web server, updated every minute. But she knows that just a table is frustrating — the ops team wants to investigate anomalies without asking her to run a new search every time.
Step by step, Priya adds interactivity. First, she adds a dropdown labelled 'Server Name' that lists all production servers: Web01, Web02, Web03, and Web04. When a team member selects 'Web01', all the charts on the dashboard update to show only Web01's data. She adds a time range picker so they can look at the last hour, last 24 hours, or a specific date range. She then adds a radio button with two options: 'Show All Events' and 'Show Errors Only'. When the ops analyst selects 'Errors Only', the dashboard hides all normal logs and displays only critical error messages.
Now for drilldown. Priya makes the server status table interactive. If an ops analyst clicks on a row showing 'Web03 - DOWN', the dashboard opens a new dashboard called 'Server Detail'. That new dashboard automatically shows the detailed logs from Web03 for the 15 minutes before the failure. This saves the ops analyst from manually searching for that information.
Once the dashboard works well for her, Priya shares it. She goes to the dashboard settings and sets permissions so that the role 'Operations Team' can view (but not edit) the dashboard. She also generates a shareable URL and sends it to the operations manager in an email. She sets the dashboard to auto-refresh every 60 seconds so the team always sees the current status of the servers.
Later, a security team member asks to see the dashboard. But the security analyst does not have permission to view the server logs that the dashboard queries. When they access the dashboard, the charts appear empty. Priya contacts the administrator, who grants the security analyst the necessary data permissions. After that fix, the security analyst can see the same data and use the interactive controls to filter and investigate.
This real-world scenario shows exactly how interactive dashboards solve a common business problem: giving the right people the ability to ask their own questions of live data without needing to know a search language.
The SPLK-1002 exam tests your knowledge of dashboard interactivity and sharing in specific, predictable ways. The exam is multiple-choice, and you need to recognise the correct term, action, or concept from a list of options. The questions are not about building dashboards in the Splunk user interface — they test your understanding of the vocabulary and behaviour of interactive elements.
Here are the exact concepts the exam loves to test about interactivity:
- Types of interactive elements: You must be able to identify a dropdown, radio button, checkbox, multiselect, time range picker, and link. The exam may show a description of a control (e.g., 'Allows you to select one option from a small set') and ask you to name it.
- Tokens: Know that a token stores a value that can be used across the dashboard. The exam may ask: 'What is used to pass a value from one element to another on a dashboard?' The answer is a token.
- Drilldown: Understand that drilldown makes a chart or table clickable and can open searches or other dashboards. A common question: 'What feature lets a user click on a table row to see more detailed information?' The answer is drilldown.
- Sharing methods: Be able to distinguish between sharing with specific users/roles and generating a shareable URL. The exam might ask: 'Which method allows you to set read or write permissions for individual users?' That is sharing with a role or user, not just a URL.
- Permissions: You need to know that sharing a dashboard is not enough — the viewer must also have permissions on the underlying data. The exam may include a trap scenario: 'You share a dashboard with your team, but they see empty charts. What is the most likely cause?' The answer is that they lack permissions on the data sources.
Traps the exam sets:
- 'Which element allows you to select multiple options?' The trap is that a 'dropdown' sounds generic enough to be correct, but the correct answer is 'multiselect' or 'checkbox'. Learn the difference. - 'A radio button is used when...' The trap is a distractor that says 'when you need to select multiple items'. Radio buttons only allow one selection, while checkboxes allow multiple. - 'What happens when you share a dashboard via URL?' The trap might say 'Anyone with the link can see it without logging in.' The correct answer is that users must still log in with their own credentials and have permission.
Key definitions to memorise:
- Token: A placeholder that holds a value and can be used in searches or dashboard elements. - Drilldown: An interactive action that occurs when you click on a dashboard element, such as a chart or table. - Dropdown: A list that allows you to select one item from multiple choices. - Multiselect: A list that allows you to select multiple items at once. - Time range picker: A control that lets you choose the time period for data displayed. - Role-based access: Setting permissions based on the role (group) a user belongs to.
The exam expects you to apply this knowledge to simple scenarios. For example, a question might describe a dashboard where clicking on a chart opens a new dashboard showing detailed logs. You need to answer that this is called 'drilldown'. Another question might say: 'Which control would you use to let a user choose between a bar chart and a line chart?' The correct answer is a radio button because it offers a choice between mutually exclusive options.
Interactive elements like dropdowns, radio buttons, checkboxes, and multiselects allow viewers to filter dashboard data without writing new searches.
A token is a placeholder that stores a value chosen by the viewer and passes it to dashboard panels to update the displayed data automatically.
Drilldown lets you click on a chart or table element to open a more detailed view, such as a new dashboard or a specific search, passing context via tokens.
Sharing a dashboard is separate from granting data permissions — viewers need access to both the dashboard and the underlying data sources to see results.
Auto-refresh updates the dashboard data at a regular interval but does not save custom filters the viewer applied before the refresh occurred.
You can share a dashboard by setting permissions on specific users or roles, or by generating a shareable URL that users must still authenticate to access.
These come up on the exam all the time. Here's how to tell them apart.
Dropdown
Allows selecting only one option at a time
Best for mutually exclusive choices (e.g., choose a single department)
Uses less space on the dashboard screen
Multiselect
Allows selecting multiple options simultaneously
Best for non-exclusive choices (e.g., pick several servers to compare)
Can expand to show multiple selected values, taking more space
Static Dashboard
Shows one fixed view of data at the time it was created
Viewer cannot change filters or explore further
Useful for scheduled reports but not for live troubleshooting
Interactive Dashboard
Updates dynamically when viewer selects different options
Viewer can filter, drill down, and customise the view
Essential for operational monitoring and real-time analysis
Sharing with a URL Link
Anyone with the URL can access it if they have permission
Requires users to log in with their own credentials
Does not allow granular control per user (all viewers see the same dashboard)
Sharing with Role-Based Permissions
You specify exactly which roles or users can view or edit
Enables fine-grained access control (Read vs Write vs Full Control)
Best for managing access across multiple teams and departments
Drilldown to Search
Opens a new search results page with the clicked value as a filter
Shows the raw log events matching the clicked data point
Best for when you need to see the exact underlying data
Drilldown to Dashboard
Opens another pre-built dashboard with the clicked value as context
Shows a structured view with charts and tables, not raw events
Best for when you want to maintain a clean, user-friendly experience
Mistake
Sharing a dashboard automatically gives the viewer access to all the underlying data even if they didn't have permission before.
Correct
Sharing a dashboard only controls access to the dashboard itself. Viewers still need their own permissions on the underlying data sources (indexes, sourcetypes) to see the data. If they lack those permissions, the dashboard will show empty charts or error messages.
This mistake is common because beginners expect that sharing a report (like a PDF) vs sharing a live dashboard are the same. They don't realise that Splunk enforces data security separately from dashboard sharing.
Mistake
A multiselect dropdown and a regular dropdown are the same thing, just with different names in the user interface.
Correct
A regular dropdown allows only one selection at a time. A multiselect dropdown allows you to pick multiple options simultaneously. They are different controls with different settings and use cases.
The names sound similar, and beginners often skip the technical detail. They think 'dropdown' is one generic type, but Splunk specifically distinguishes them.
Mistake
Creating a static dashboard is just as useful as an interactive one, and interactivity is just a 'nice to have' feature.
Correct
Interactivity is essential for most real-world use cases. Static dashboards show one view of data at one time. Interactive dashboards let viewers filter, drill down, and customise the view without writing new searches, making them far more practical for troubleshooting and analysis.
Beginners who are still learning to build dashboards may not yet understand the difference in utility. They might think a dashboard is 'done' once it looks nice, forgetting that the main point is to enable exploration.
Mistake
If you set a dashboard to auto-refresh, it automatically applies updates to filters and selections made by the viewer.
Correct
Auto-refresh simply reloads the dashboard data at a set interval. It does not save or persist any filters the viewer applied manually. When the dashboard reloads, it resets to the default state unless the viewer has saved a custom version.
Users expect auto-refresh to 'remember' their choices, like a web page that keeps your form inputs after a page reload. But Splunk dashboards do not work that way by default.
Mistake
A time range picker is the only way to change the time range for a dashboard.
Correct
You can also use a relative time range in the base search of the dashboard, or use tokens to pass time values from other controls (like a dropdown of time presets). The time range picker is one option, but not the only one.
Beginners often think the only visible time selector is a time range picker, not realising that Splunk allows more flexible token-based time handling.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Create a dropdown input, define a token name (e.g., $server$), then edit each panel's search to reference that token (e.g., | search server=$server$). When the user picks an option, all panels automatically update because they all use the same token.
No. Every person who accesses a Splunk dashboard must have a Splunk user account with the necessary permissions. You cannot share a dashboard with external users unless you have a way to authenticate them in your Splunk instance.
The dropdown may be populated by a search that is returning no results or has an error. Check that the search for the dropdown options is correct and that there is data in the index it queries. Also verify that the token name matches exactly in the dashboard panels.
A radio button is best when you have only a few (2-5) mutually exclusive choices, like On/Off. A dropdown is better when you have many choices (like a list of 50 servers) because it takes up less space on the dashboard.
When you set permissions, only assign the 'Write' or 'Full Control' level to people you want to be able to edit. Give everyone else 'Read' access. This means they can see the dashboard and use interactive controls, but they cannot change the layout or save modifications.
Yes. Enable drilldown on a chart or table, and set the action to 'Open Dashboard'. Choose the target dashboard and map the clicked data value to a token that the target dashboard will use to filter its data. This creates a smooth transition between dashboards.
You've finished Dashboard Interactivity and Sharing. Continue through the SPLK-1002 study guide to build a complete picture of the exam.
Done with this chapter?