A dashboard is a single screen that collects and displays the most important data from multiple sources in one place. It matters for the SPLK-1002 exam because you will need to build dashboards that let non-technical people — like managers or support teams — understand what is happening with their systems without writing any search commands themselves.
Jump to a section
A simple way to picture Fundamentals of Dashboards
A professional chef runs a kitchen with 4 different cooking stations: a grill, a stove, an oven, and a salad prep area. Each station has its own timer, temperature gauge, and ingredient stock indicator. The chef needs to know at a glance: is the steak medium-rare on the grill? Is the sauce simmering correctly on the stove? Is the cake done in the oven? And are there enough tomatoes for salads?
Instead of running between stations every minute, the chef uses a single digital display hanging on the wall. This display shows a small box (a panel) for each station. The grill panel shows the timer and the steak's current internal temperature. The stove panel shows the sauce temperature. The oven panel shows the remaining bake time. And the salad panel shows the current stock level of tomatoes. A dropdown menu at the top (a form input) lets the chef filter by meal service — lunch or dinner — so each panel updates to show only the data relevant to that service. A clock (a time range picker) lets the chef compare the current performance to last Tuesday's dinner rush, to see if things are running faster or slower.
The dashboard is the single screen that pulls all these panels together. It solves the same problem an IT professional faces: monitoring several systems at once without logging into each one individually, and quickly filtering data by time or category to spot problems or trends.
A dashboard in Splunk is a collection of panels arranged on one page. Each panel is a self-contained block that shows the result of one search, one chart, or one table. Think of it as a control panel for your data.
Before dashboards existed, IT professionals had to run individual searches every time they wanted to check something. If a manager asked "How many errors did we get yesterday?", you would log into Splunk, type that exact search, look at the numbers, then close the window. If they asked again tomorrow, you would repeat the whole process. Dashboards solve this by saving those searches and displaying their results automatically every time someone opens the dashboard.
Here are the main building blocks of a Splunk dashboard:
Panels: Each panel holds one search result. You can display that result as a table (rows and columns), a chart (bar chart, line chart, pie chart), a single number (like a counter), or a map. You add panels by telling Splunk which search to run and how you want to see the output.
Forms: A form is a set of input controls — like dropdown menus, text boxes, or checkboxes — that let a user change what the panels show without editing the dashboard. For example, a dropdown labelled "Region" might let the user pick "US", "Europe", or "Asia", and every panel on the dashboard will update to show data only from that region. The inputs feed variables into each panel's search.
Time range picker: This is a special input that lets the user choose a time window — "Last 24 hours", "Last 7 days", "This month", or a custom date range. Every panel that uses the time picker will automatically rerun its search for the selected period. This is essential because most operational questions are time-bound: "What happened last night?" versus "What happened this morning?"
When you build a dashboard, you decide the layout. You can place panels side by side or stack them vertically. You can also add a title and description so anyone who opens it knows immediately what it shows.
Why does this exist? It replaces the manual workflow of writing searches on demand. Instead of typing the same search twenty times a day, you build one dashboard that refreshes automatically. This is critical in a business context because managers, support staff, or even customers can look at the dashboard and get answers instantly, without learning Splunk's search language.
Here is a realistic example of how the dashboard components work together:
Imagine a company runs an e-commerce website. The IT team builds a dashboard called "Website Health". It has three panels:
A panel showing the number of active users right now, displayed as a single large number.
A panel showing the server response time over the last hour, displayed as a line chart.
A panel showing the top 5 error messages from the last 24 hours, displayed as a table.
At the top of the dashboard, there is a time range picker set to "Last 24 hours" by default. Next to it, there is a dropdown form input labelled "Server Location" with options: "All", "US-East", "Europe-West". When a manager selects "Europe-West", the active users panel recalculates to show only users in that region, the response time chart redraws for that region's servers, and the error table filters to errors from that region.
The dashboard refreshes itself periodically — every 30 seconds or every minute — so it always shows near-real-time data without anyone clicking a refresh button.
To create a dashboard, you use Splunk's Dashboard Editor, which is a visual interface where you drag and drop panels, configure their searches, and set up form inputs. Alternatively, you can define a dashboard using a language called XML (Extensible Markup Language), which is like writing instructions for Splunk in a structured text file. The SPLK-1002 exam tests your understanding of how panels, forms, and time range pickers work, not necessarily how to write the XML from scratch. You need to know what each component does and how they relate to each other.
1. Identify the goal of the dashboard
Decide what question the dashboard should answer. For example: 'What is the current status of all our web servers?' This step matters because it determines which searches and panels you need.
2. Write the searches for each panel
For each piece of information you want to see, write a search in Splunk. For example, for a server status panel, the search might be: index=main sourcetype=access_log status=200. This step is essential because each panel needs a search to produce its data.
3. Choose the visualisation type for each panel
Decide if each search result should appear as a table, a line chart, a bar chart, a single number, or a map. This step determines how easy the data is to interpret. For trends, use a line chart; for counts, use a single value.
4. Add form inputs for filtering
If the dashboard should let users filter by something like region or product, add a dropdown or text box using the Dashboard Editor. This step makes the dashboard interactive and useful for different audiences.
5. Add and configure the time range picker
Add a time range picker to let users select the time window for the data. Configure which panels will use this time picker. This step is crucial because most operational questions are time-sensitive.
An IT professional on a support team at a large bank builds a dashboard to monitor the ATM network. Before the dashboard, whenever a customer complained that an ATM was offline, the support agent had to log into a separate monitoring system for each ATM, check its status, and then report back. This took about 15 minutes per complaint, and the bank processed hundreds of complaints daily.
The IT professional builds a Splunk dashboard called "ATM Network Status" with these panels:
A map panel showing all ATMs in the city, with green icons for online and red icons for offline.
A chart panel showing the number of transactions per hour over the last 24 hours, broken down by ATM location.
A table panel listing the top 10 ATMs with the highest error rates in the last 7 days.
A single-value panel showing the total number of ATMs that are currently offline.
They add a form input — a dropdown labelled "Region" — with values for each city district: Downtown, Uptown, Suburbs. When a support manager selects "Downtown", every panel updates to show data only for ATMs in that district. This helps the team quickly identify if a specific area has a widespread problem.
They also add a time range picker set to "Last 4 hours" as the default, but the manager can change it to "Yesterday" to compare today's performance with the same time yesterday.
Now, when a customer calls to report an offline ATM, the support agent opens the dashboard. They select the customer's region from the dropdown, look at the map to see if the ATM appears red (offline), and can immediately tell the customer: "Yes, we see that ATM is down. We are already working on it. Estimated fix time is 30 minutes." The whole process takes less than 30 seconds.
The dashboard also helps the team spot trends. If the error table shows a spike in errors for a specific ATM model, they can proactively check all ATMs of that model before customers even notice.
The dashboard runs automatically on a big screen in the operations centre, so the team always has a live view without anyone having to refresh it. This is a common real-world use of dashboards: enabling faster decision-making, reducing manual work, and providing a single source of truth for operational status.
The SPLK-1002 exam tests your understanding of the fundamental components of a dashboard and how they work together. You will not be asked to build a full dashboard from scratch in the exam, but you will get multiple-choice questions about the purpose and behaviour of panels, forms, and time range pickers.
Here are the exact concepts the exam loves to test:
What is the difference between a panel and a dashboard? A panel is a single component inside a dashboard that shows one search result. A dashboard contains one or more panels. They may ask: "Which of the following contains one or more panels?" with options like "Search", "Report", "Dashboard", "Alert". The answer is Dashboard.
What does a form input do? A form input lets a user modify the data shown without editing the dashboard. They might present a scenario: "A user selects 'East' from a dropdown in a dashboard. What happens?" The correct answer is that the panels will update to show data matching the 'East' filter.
How does a time range picker affect panels? When a user changes the time range picker, all panels that are attached to it will rerun their searches for the new time range. The exam may present a dashboard with two panels — one using the time picker and one using a fixed time range — and ask which panel changes when the time picker is adjusted. The answer: only the panel that uses the time picker changes.
Which panel types exist? The exam expects you to know that panels can display results as: tables, charts (bar, line, pie, column), single values, maps, and lists. They might ask: "Which panel type is best for showing a trend over time?" Answer: a line chart.
What are the standard time range options? The exam tests that you know common options like "Last 15 minutes", "Last hour", "Last 4 hours", "Last 24 hours", "Last 7 days", "Last 30 days", "Yesterday", "This week", "This month", and custom date ranges.
How do you add a time range picker to a dashboard? The exam may ask about the process: you use the Dashboard Editor to add a "Time" input element, then link it to the panels that should use it.
What is the default setting for a time range picker? The default is usually "Last 24 hours" unless you change it.
Common traps in the exam:
They will try to confuse panels with reports or searches. Remember: a report is a saved search with a visualisation; a dashboard is a collection of panels. A panel can display a report, but a panel is not a report itself.
They might describe a scenario where a form input changes the time range. That is wrong: a form input changes data filters (like region or product), not the time range. The time range picker is a separate component.
They could ask: "A dashboard has three panels. One uses a time range picker, the other two do not. The user changes the time range. How many panels update?" Answer: only one. The other two ignore the time picker because they were not configured to use it.
Key definitions to memorise:
Dashboard: A collection of panels on one page that displays real-time data from one or more searches.
Panel: A single container in a dashboard that shows the output of one search.
Form input: A dropdown, text box, checkbox, or radio button that filters the data shown in panels.
Time range picker: A special input that lets the user choose a time window for the data displayed.
Dashboard Editor: The visual tool within Splunk used to create and edit dashboards.
A dashboard is a single page that displays multiple panels, each showing the result of one search, to give an at-a-glance view of key data.
Panels can display data as tables, charts, single values, or maps, depending on what you want to show.
A form input (like a dropdown) lets users filter the data across all linked panels without editing the dashboard.
A time range picker lets users choose a time window, and only panels connected to it will update their data for that period.
Dashboards refresh automatically at a set interval (e.g. every 30 seconds) to show near-real-time data without manual refresh.
The SPLK-1002 exam tests your conceptual understanding of dashboard components, not your ability to write XML code.
These come up on the exam all the time. Here's how to tell them apart.
Panel
Shows the result of one search
Is a single component inside a dashboard
Cannot contain other panels
Dashboard
Contains one or more panels
Is the overall page that organises panels
Can include form inputs and time pickers
Form Input
Filters data by a field like region or product
Is a dropdown, text box, checkbox, or radio button
Changes which subset of data is shown
Time Range Picker
Filters data by a time window (last 24 hours, yesterday, etc.)
Is a dedicated clock or calendar control
Changes the time period of the data shown
Saved Search
A single search query saved for reuse
Shows results in one view (table/chart)
Is not interactive (no filter controls)
Dashboard
A collection of multiple saved searches or reports
Shows multiple views on one page
Is interactive with form inputs and time pickers
Mistake
A dashboard is the same as a saved search.
Correct
A saved search is a stored query that you can run later; a dashboard is a collection of one or more panels that display the results of searches, often with interactive controls like dropdowns and time pickers.
Both terms involve saving something for reuse, so beginners assume they are interchangeable. But a dashboard is a page containing multiple panels, whereas a saved search is just one search, typically viewed as a single result.
Mistake
When you change the time range picker on a dashboard, every panel automatically updates.
Correct
Only panels that are explicitly configured to use the time range picker update. Panels with a fixed time range or no time picker link will not change.
It seems logical that a dashboard-wide control would affect everything, but Splunk allows panels to have independent time ranges, which is a common exam trap.
Mistake
A form input and a time range picker are the same thing.
Correct
A form input filters data by a specific field (e.g. region), while a time range picker filters by time. They are separate components with distinct purposes.
Both are interactive controls that change what the dashboard shows, so beginners lump them together. The exam explicitly tests the difference.
Mistake
You need to know XML code to pass the SPLK-1002 exam dashboard questions.
Correct
The SPLK-1002 exam tests your understanding of what dashboards, panels, forms, and time range pickers do conceptually. It does not ask you to write or read XML code.
Some study materials spend a lot of time on XML, which scares beginners. The exam focuses on practical knowledge of components, not text-based configuration.
Mistake
A dashboard can only have one panel.
Correct
A dashboard can contain one panel or multiple panels arranged in a grid. The whole point of a dashboard is to combine several data views in one place.
The word 'dashboard' might suggest a single gauge, like a car dashboard, but in Splunk it is a collection of many panels.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A report is a single saved search with a visualisation that you can run anytime. A dashboard is a page that contains one or more panels, each of which can show the result of a different search, report, or chart.
Yes, you can add more than one time range picker, but each panel can only be linked to one at a time. This is useful if you want different panels to show data from different time periods.
When you edit a panel in the Dashboard Editor, you can set a refresh interval (e.g. 30 seconds, 1 minute). The panel will then rerun its search at that interval and update the display.
Only that panel is removed. The other panels and the dashboard itself remain unchanged. The search that the panel used still exists unless you also delete it separately.
No, the Dashboard Editor in Splunk lets you build dashboards visually without any coding. For the SPLK-1002 exam, you only need to understand what each component does conceptually.
Yes, you can share a dashboard with specific users, roles, or everyone. The sharing settings are in the dashboard's permissions. This is how teams collaborate using dashboards.
You've finished Fundamentals of Dashboards. Continue through the SPLK-1002 study guide to build a complete picture of the exam.
Done with this chapter?