Navigating Splunk Web

This topic discusses navigating the different views in Splunk Web, the Splunk web browser interface.

About Splunk Home

The Splunk Home page is your interactive portal to the data and apps in your Splunk deployment. The first time you log into your Splunk deployment, you land on the Splunk Home page. All of the apps that you have access to appear on this page.

You can personalize the home page with in-product bookmarks for quick access to guides, manuals, apps, knowledge objects, and so on.

Administrators can:

  • Share bookmarks with all users in one operation.
  • Control the domains in which bookmarks can be created.

Users can:

  • Access your search history for various apps in a single view, without having to navigate to each app to see the history associated with that app.
  • Filter the Knowledge Object list by App and Owner for quicker access to those objects.

There are minor differences between the Splunk Home page for Splunk Enterprise and Splunk Cloud Platform.

The following image shows the Home page for a user with administrator access on Splunk Enterprise:

This image shows the Splunk Home page for Splunk Enterprise. The Apps panel extends the full length of the left side of the window. The Splunk bar is at the top of the window. There is a set of quick link tabs above the center panel. The first tab is for bookmarks. The other tabs contain quick links for common tasks.

Your Splunk account might be configured to start in another view instead of Splunk Home, such as Search or Pivot in the Search & Reporting app.

Apps panel

The Apps panel lists the apps which are installed on your Splunk instance and that you have permission to use. Select an app from the list to open it.

By default the Search & Reporting app, which is often referred to as the Search app, is pinned to the top of the list. For apps that you use frequently, you can pin the apps to move them to the top of the list.

The center panel contains a set of quick link tabs. The first tab is Bookmarks, where you can set your own bookmarks and see the bookmarks shared with you. The other tabs provide quick access to other information.

Splunk Home has a set of tabs that you can use to gain access to information. The following table describes these tabs:

Tab Description
Bookmarks Use this tab to access your own bookmarks, bookmarks your organization has defined, and Splunk recommended bookmarks.
Dashboard Use this tab to access your favorite dashboard faster. You can add a dashboard created either using Simple XML or created through Dashboard Studio as your home dashboard.
Search history This tab shows the list of searches that you've run recently. You can set how far back to keep the search history. The maximum is the last 90 days.
Recently viewed This tab shows the list of knowledge objects that you accessed in the last 30 days, including alerts, dashboards, datasets, and reports.
Created by you This tab shows all of the knowledge objects that you have created, organized by knowledge object type.
Shared with you This tab shows all the knowledge objects that you have access to, organized by knowledge object type.

About the Splunk bar

Use the Splunk bar to navigate Splunk Web. You can use the Splunk bar to switch between apps, add data, manage settings and edit your Splunk configuration, view system-level messages, monitor the activity of your search jobs and alerts, and get help using Splunk software.

The Splunk bar in another view, such as the Search view in the Search & Reporting app, also includes the Apps menu next to the Splunk logo. Use the Apps menu to quickly switch between the Splunk applications that you have installed on your Splunk instance.

The following image shows the Splunk bar in the Search app in Splunk Enterprise. The Splunk bar in Splunk Cloud Platform has the same elements and menus.

This image shows the Splunk bar in the Search app in Splunk Enterprise. From left to right, the first item on the Splunk bar is the Splunk logo. The second item is the Apps menu. To the right are several other menus, such as User, Messages, and Settings, which are described in the following sections.

Messages menu

All system-level error messages are listed on the Messages menu. When you have a new message to review, a numerical notification appears next to the Messages menu. The notification indicates the number of messages that you have.

This image shows the Messages menu on the Splunk bar. In front of the Messages menu, is a blue circle with the number two inside the box.

Settings menu

The Settings menu lists the configuration pages for knowledge objects, distributed environment settings, system and licensing, data, and authentication settings. If you do not see some of these options, you do not have the permissions to view or edit those options.

The following image shows the Settings menu in Splunk Cloud Platform: This image shows the Settings menu on the Splunk bar for a Splunk Administrator in Splunk Cloud Platform. The Settings menu contains options to manage Knowledge objects, Data, System settings, Distributed Environment settings, and User access.

The Settings menu in Splunk Enterprise contains the same options, however there are several additional large icons to the left of the menu to access the Explore Data and Monitoring Console pages.

Activity menu

The Activity menu provides shortcuts to the Jobs and Triggered alerts views.

  • Click Jobs to open the search jobs manager window, where you can view and manage currently running searches.
  • Click Triggered Alerts to view scheduled alerts that are triggered.

Find search box

To search for objects within your Splunk deployment, use the Find search box. The Find search box performs matches that are not case sensitive on the ID, labels, and descriptions in built-in and saved objects. For example, if you type error, it returns the knowledge objects that contain that term.

This image shows the word "error" typed into the Find search box. The results that appear are a mix if built-in and saved objects, such as reports and dashboards.

The saved objects, where they exist, are organized into the following categories: Reports, Dashboards, Datasets, and Data models.

You can also run a search for the word error in your event and metric data. Select Open error in search to run a search in the Search & Reporting app, using the word you specified in the Find search box.

User menu

Use the user menu to edit your account settings, change preferences, or to log out of the Splunk instance.

  • If you installed Splunk, for example to step through the Search Tutorial, the user menu displays "Administrator" because that is the default user name for a new installation.
  • If you are a user, the name on the user menu is your Splunk user name.

This image shows the User menu which displays the options Account Settings, Preferences, and Logout.

Preferences

Through the Preferences menu, you can:

  • Set a time zone that is different than the default system time zone.
  • Set a default application other than Splunk Home.
  • Restart background search jobs when the Splunk software is restarted.
  • Change the background to a dark theme. The default is a light theme.

Help and Support

For assistance, such as to access the Splunk Support portal and Splunk Answers, to file a bug, or to get help on a specific page, use the menu the corresponds to your Splunk instance:

Splunk Cloud Platform

Use the Support and Services menu on the Splunk bar.

Splunk Enterprise

Use the Help menu on the Splunk bar.

Return to Splunk Home

Select the Splunk logo on the Splunk bar to return to Splunk Home from any other view in Splunk Web.