Why create splunk dashboards vs views?

Question

I'm trying to figure out why anyone would want to create a dashboard in Splunk. Views allow you to add forms along with any charts and searches, while dashboards do not. So, why would I want to make a dashboard? Is there any advantage of one vs the other?

Answer 1

A dashboard is a special case of view.

A normal view would allow you to change search conditions and hence view the changed results.

Dashboards are useful to as they consist of multiple panels and can accumulate data from multiple datasources into one quick view.

For example if you want to view the number of errors and map that against the CPU on the box at the same time, the dashboard comes in handy

Answer 2

Hmmm... not sure I'd agree with the answer above... They are all "views", one way of looking at it, is that forms and dashboards are all stored under the same locations, whether it be accessed through the GUI (under 'Manager>>User Interface>> Views'), or it be accessed through the CLI (e.g. $SPLUNK_HOME/etc/apps/<yourApp>/default/data/ui/views/). Additionally in advanced XML they all start with the opening tag, "<view>".

To add a bit more...

A dashboard is a type of view (typically referring to a view with no user control), in advanced XML, you start it with the <view> tag.

A form is a type of view (typically referring to a view with user control), in advanced XML, you start it with the <view> tag. It's just a mix-up in terminology.

Perhaps the confusion lies with the differences between Simple XML and Advanced XML. Ultimately Splunk will convert Simple XML to Advanced anyway when it reads it.