Edit a Dashboard

Learn how to edit a Dashboard in Cribl Search.

Within a Dashboard, you can add and edit visualization panels. You can also add Dashboard-level inputs that apply to all visualizations on the Dashboard.

To edit the built-in Sample Dashboard, you need to clone it first. Go to Dashboards > Sample Dashboard > > Clone.

Add a Visualization

​

1. In an open Dashboard, select Edit at the top right, or press e on your keyboard.
2. From the Add drop-down, select Visualization.

Next, choose how to define your visualization: by reviewing Cribl Copilot AI suggestions; or by configuring it yourself, based on a new or existing search.

Cribl Copilot AI Suggestions

​

To have Cribl Copilot suggest visualizations that display your data effectively:

1. At the top of the page, select the Cribl Copilot button .
2. The right drawer, now labeled Copilot, will prompt you to select or change the base Dataset for this visualization.
3. From the tiles that Cribl Copilot suggests, select Add to add the visualization you choose.

For details, see Add a Visualization when Editing a Dashboard.

New Search

​

If you want to base your visualization on a New Search (the default setting in the right drawer):

1. Either enter your query directly, or select a Parent search ID to pre-populate your query from a parent search (see Apply a Parent Search below).
2. Optionally, if you’ve started with a parent search, you can append terms to the query before proceeding.
3. Select Search.

To start over, select Reset. This clears the query and all chart settings.

Existing Search

​

If you prefer to base your visualization on an existing saved search (which can be a scheduled search):

1. In the right drawer, select Saved.
2. Select a Saved search ID to populate your query.
3. Optionally, append terms to the query before proceeding.
4. Set the Run mode:
   • Run as new search – Always rerun the query, even if the Dashboard has data caching enabled.
   • Fetch results from last run – Get results from the most recent run. (If the Dashboard has data caching enabled, Cribl Search will ignore this setting.) Cribl recommends selecting this option if you’re basing this visualization on a scheduled search.
5. Select Search.

To start over, select Reset. This clears the query and all chart settings.

Edit a Visualization

​

To edit an existing visualization:

1. Open an existing Dashboard.
2. At the top right of the visualization panel you want to modify, select Edit . Depending on the layout, you might need to select the Actions button first.
3. Edit the visualization just like you edit a Chart display. The options available depend on the Chart type used.

If you add a visualization by creating a new search, you’ll see additional options to configure the type, format, and data display of the visualization.

If you create a visualization from a saved search, you can select Edit at the visualization panel’s top right to revise the visualization.

Hide a Visualization

​

You can hide any visualization panel by editing it and selecting the Hide this panel check box.

• In Dashboard edit mode, hidden panels are collapsed into a Hidden Panels section.
• To unhide a panel, edit the panel and clear the Hide this panel check box.

Interact with Visualizations in a Dashboard

​

Within any visualization panel, you can hover over graphics or expand list events to see more details. Also, the Actions buttons on the Dashboard, and on individual panels, offer further options.

Rearrange Visualization Panels

​

To arrange the visualizations in a Dashboard, select Edit at the top right, or press e on your keyboard. Use the drag handle at the top of any panel to drag it to a new position, and use the resize handle at the bottom right or left to resize it.

Refresh Visualizations

​

Refresh the data in a visualization by clicking the Refresh button at the top right of the panel.

To refresh all of the Dashboard’s visualizations automatically, see Refresh Your Dashboards Automatically.

Manage Visualizations

​

Select a visualization panel’s own Actions button to expose the menu options shown below.

The options here include:

• Edit: Opens the visualization panel for editing.
• Clear Cache and Refresh: A hard refresh of the visualization, to match current underlying data.
  To refresh all of the Dashboard’s visualizations automatically, see Refresh Your Dashboards Automatically.
• Open Search Details: Opens a read-only version of the Details modal, listing the search’s query expression, execution times, and duration.
• Open in Search: Opens an editable version of the query expression.
• Full Screen: Zooms up an expanded display of the visualization, in a modal within your browser window.
• Copy to Clipboard: Copies the current visualization, as a static image, to the system clipboard.
• Export Visualization as PNG/JPG: Saves the current visualization as a static image in .png or .jpg format.

Apply a Parent Search

​

To reduce effort and significantly improve Dashboard loading time, you can reuse search results by saving them as parent searches. You can instantly add an existing search query to a visualization panel by designating another visualization in the same Dashboard as the parent search. This enables you to aggregate results from both searches into the same visualization.

1. Edit an existing Dashboard, and then select Edit at the top right of the visualization panel you want to modify.
2. Under Parent search, select the name of the visualization you want to use as the parent.
3. The parent search query becomes the new first line of your query in the Search box. Select Search to test your new aggregate query, and then select Save to save your Dashboard.

Hide a Parent Search

​

You can hide any visualization by editing it and selecting the Hide this panel check box. This can be especially useful for visualizations you create for the sole purpose of acting as parent searches.

Parent Search Limitations

​

You can apply only one parent search per visualization panel.

When you apply a parent search, child searches wait until the parent search has completed. So you will not see “preview” results.

When you’ve applied a parent search to a visualization, and you open that visualization (using Actions > Open in Search), you won’t be able to edit the child search’s time parameters. This is because the child search is using the parent search’s time span.

Add Inputs

​

Inputs help constrain the view of visualization panels in a Dashboard by linking them to specific data sources. To add an input to a Dashboard:

1. In an open Dashboard, select Edit at the top right, or press e on your keyboard.
2. From the Add drop-down menu, select Input.
3. Give the input a title, and then select an option from the Type drop-down.
4. Optionally, enter an Input ID containing alphanumeric characters, underscores, and hyphens only. This ID acts like a variable that you can reference from visualization panels in your Dashboard, causing them to display only certain data. When you save an input, a new input box at the top of your Dashboard displays values related to the input you created. Selecting options in the input box changes the display of data in any linked visualizations.
5. In the Type drop-down, select Dropdown, Time Range, Text, or Number, fill out the remaining details as explained just below, and then select Save.

Input Types

​

Here are the input Types available, and how to enable them.

Dropdown

​

Use this input to enable users to choose from values you’ve specified. This will constrain linked visualization panels to those values.

1. Create a new Dropdown input by entering a Title and Input ID, selecting the method you want to use to populate the dropdown, and entering specifications for the chosen method.

2. Select how to populate the drop-down list: New search, Saved search, or Manually add dropdown items.

3. In the Field name (with the search options) or in the Values (with the manual option): Enter a caption that will convey the item’s purpose, when Dashboard users select from the drop-down.

4. Edit a visualization that you want to link to this input, and reference its Input ID in the visualization’s search query, surrounded by $. For example, if the input ID is firstname, reference $firstname$ in the search query. Dropdown options can be dynamic, based on any valid data returned from any search query.

Time Range

​

Use the Time Range input to allow users to limit any visualization in a Dashboard to a specific time period.

1. Create a new Time Range input by entering the Title and Input ID you want.
2. Edit a visualization panel that you want to link to this input.
3. Select the clock button in the date and time selector.
4. Select the Link tab.
5. Select the Time Range input you just created.

When a Time Range input is linked to a visualization, the Input ID appears in that visualization’s date and time field.

Text

​

Use the Text input to enable a user to enter freeform text so that linked visualization panels display only data with that text value.

1. Create a new Text input by entering the Title, Input ID, and Default value you want. Make sure to give the input a title that gives the user an idea of what they can type.
2. Then, edit a visualization that you want to link to this input, and reference its Input ID in the visualization’s search query, surrounded by $. For example, if the input ID is firstname, reference $firstname$ in the search query.

Number

​

Use the Number input to allow users to enter a number. Optionally, you can enter a default value and minimum and maximum values. Your new input appears at the top of the page as a small modal, where you can edit, clone, or delete it.

For step-by-step examples that demonstrate adding each input type to a Dashboard, see Building Dashboard and Dashboard Inputs in Cribl Search.

Add Interactions

​

You can create interactions that enable Dashboard viewers to drill down into specific Chart values. When you select a value in a visualization panel with interactions, a Dashboard opens or a new search runs based on an input or a search query provided with the Chart.

In the Format panel of a Chart, expand Interactions and select one of the following:

• Add value to Dashboard input to apply an input to a single Dashboard visualization panel. Then, when you select a value in that visualization, a new Dashboard page will open that’s populated with the selected input.

• Run a new search to create a new search based on the Chart value clicked. Enter a search query, and use $value$ to pass the clicked value to the new search.

For an interaction to pass time parameters, it must either link to a Time Range input directly, or have no time picker at all. If an interaction links to a parent search that has a time picker, it will fail.

• Open external link to open a URL in a new tab. Enter a full URL, and use $value$ to pass the clicked value to the URL. For example: https://www.virustotal.com/gui/domain/$value$.

Add Markdown

​

You can add a Markdown panel to your Dashboard to enrich it with any custom text. Use Markdown to add explanations, captions, and additional information to your Dashboard. To add a Markdown panel:

1. In an open Dashboard, select Edit at the top right, or press e on your keyboard.
2. From the Add drop-down menu, select Markdown.
3. In the Edit pane, replace the sample text with any markdown content you want.
   The panel lets you use the features of Github-flavored markdown, including links, tables, codeblocks, and images (linking to external sources).
   You can also use tokens, defined in inputs, surrounded by $. For example, if the input ID is firstname, reference $firstname$ in the markdown.
   As you edit, you will see a live preview of the rendered text.
4. Select Save.

The Markdown panel doesn’t support raw HTML.

Rename a Dashboard

​

To change the name of an existing Dashboard:

1. From the Cribl Search sidebar, select Dashboards.
2. Select the row of the Dashboard that you want to rename.
3. At the top, next to the current Dashboard name, select Settings, and then select the Edit button.
4. Enter the new Dashboard name, and select Save.

Edit Dashboards as JSON

​

You can edit your Dashboards in a JSON editor built into Cribl Search, or import and export JSON files with complete configurations. This can significantly speed up setting up more complex Dashboards.

To edit an existing Dashboard as JSON:

1. From the Cribl Search sidebar, select Dashboards, and open a Dashboard.
2. At the top right, select the Actions button.
3. Select one of the following:
   • Edit as JSON to open the Dashboard configuration in the Cribl Search JSON editor.
   • Copy Dashboard JSON to copy the Dashboard JSON to clipboard.
   • Export Dashboard JSON to download a JSON file with the Dashboard configuration.
   • Import Dashboard JSON to upload a JSON file with a new configuration.

Refresh Your Dashboards Automatically

​

You can refresh a Dashboard automatically, either by running it on schedule, or by configuring its caching.

Configure a Dashboard’s Caching

​

You can modify the time for which a Dashboard is cached (in other words, how often it is refreshed).

1. Start creating or editing a Dashboard.
2. Under Schedule, select Cache data.
3. In Cache data for, set the time-to-live (TTL) for the Dashboard cache. This setting defines how often data in the Dashboard is refreshed.

Run a Dashboard on Schedule

​

You can schedule the searches on all of a Dashboard’s visualizations to refresh on the default interval you define.

This can be advantageous on a Dashboard where you don’t need to display up-to-the-minute data, but you prefer not to wait for the display to refresh. Schedule the underlying searches to refresh daily, hourly, or every few minutes. When the visualizations render, they’ll fetch the results from the last scheduled run.

After scheduling the Dashboard as a whole, you retain the option to customize the schedules of the searches that underlie individual visualization panels and inputs.

To run a Dashboard on a schedule:

1. Start creating or editing a Dashboard.
2. Under Schedule, select Run on schedule.
3. Configure one of the two:
   • Define the timezone, the base interval (anything from year down to minute), and refresh time.
   • Or, define a Cron schedule string.
4. In Keep last executions, define how many past versions of the Dashboard data to keep.
   This is a rolling buffer – on each refresh of the Dashboard, Cribl Search will purge the oldest version beyond this count. Defaults to 2.

Changing Scheduled Dashboard Ownership

​

If the creator of a scheduled Dashboard is no longer an active Cribl Search Member, active Members with access to the Dashboard will be unable to re-run the Dashboard. They will need to export the Dashboard’s configuration, then re-create the Dashboard by importing the config, and finally schedule the new Dashboard to run under their ownership.