| name | ds-ref-archetypes |
| description | Splunk Dashboard Studio archetypes reference — the four canonical layouts (executive summary, operational monitoring, analytical deep-dive, SOC overview / wall) with panel-mix fingerprints, audience profiles, viewing context, and per-archetype defaults. Use when picking layout shape for a new dashboard, when ds-couture commits to an archetype, or when the user asks "what should this look like for X audience?". |
ds-ref-archetypes — Splunk dashboard archetypes
Scope (what's IN)
- The 4 archetypes (executive summary, operational monitoring, analytical deep-dive, SOC overview / wall) with deep-dive per archetype.
- Panel-mix fingerprints per archetype.
- Canvas dimensions per archetype (1920×1080 minimum all archetypes, per ds-ref-layout-grid §Canvas Sizes).
- When-to-use rules per archetype.
- Hybrid examples and smells (when archetypes mix).
Out of scope (what's NOT here)
- Color palette per archetype — see
ds-ref-color.
- Grid/spacing math — see
ds-ref-layout-grid.
- Anti-pattern detection per archetype — see
ds-ref-anti-patterns.
Consults
ds-ref-personas (persona → archetype mapping).
Consulted by
ds-couture (after Design Context Protocol, when committing to an archetype).ds-design (when wireframing a new layout).ds-init (during scope phase).
The four archetypes at a glance
| Archetype | Audience | Panels | Primary question |
|---|
| Executive summary | Leadership | 6–8 | Is everything healthy right now? |
| Operational monitoring | On-call, NOC | 8–12 | What is happening right now? |
| Analytical deep-dive | Analysts, investigators | 10–14 (use tabs) | What caused this and what does the data show? |
| SOC overview | SOC analysts | 7–10 | Where are threats, how severe, what just happened? |
Each archetype below documents audience, panel count, purpose, typical
panel mix, canvas dimensions, and an ASCII layout sketch.
Executive summary
- Audience: Leadership — VPs, directors, business owners.
- Panel count: 6–8 panels. Anything more dilutes the story.
- Canvas: 1920×1080 minimum. (ds-ref-layout-grid §Canvas Sizes mandates 1920×1080 minimum for all archetypes.)
- Primary question: Is everything healthy right now?
- Purpose: A single calm story per dashboard. Each panel answers
"yes / no / by how much" against a target. The viewer spends ~90
seconds scanning before clicking away or asking a follow-up.
Typical panel mix:
- 4-KPI strip across the top (the headline numbers, with trend deltas
and units).
- 1 trend chart (line) showing the headline metric over the period.
- 1 part-to-whole (pie / donut ≤6 slices, or sorted bar) for mix.
- 1 status table (top-N services / regions / business units, status
coloured).
- Optional: 1 markdown panel framing the period and the takeaway.
ASCII layout:
+-----------------------------------------------------------+
| KPI 1 | KPI 2 | KPI 3 | KPI 4 |
| big num | big num | big num | big num |
+-----------------------------------------------------------+
| |
| Trend over time (line) |
| |
+-------------------------------+---------------------------+
| | |
| Mix (pie / sorted bar) | Top-N status (table) |
| | |
+-------------------------------+---------------------------+
Operational monitoring
- Audience: On-call SREs, NOC operators, platform teams.
- Panel count: 8–12 panels.
- Canvas: 1920×1080 minimum.
- Primary question: What is happening right now?
- Purpose: A dense status surface that surfaces the live state of
every critical service. The viewer drops in for 5–15 minute
check-ins, scans the wall for red, and drills into specifics.
Typical panel mix:
- Service / host status grid (singlevalueicon or coloured table rows).
- 2–4 line / area charts for core metrics (latency p95, error rate,
throughput, saturation — RED + USE).
- 1 event / alert feed (events viz or table sorted by time).
- 1 capacity gauge (fillergauge or markergauge).
- Heatmap or punchcard for hour×weekday patterns when relevant.
ASCII layout:
+---------------------+---------------------+---------------------+
| Service status | Active alerts | Capacity gauge |
| (icon grid) | (count + severity) | (fillergauge) |
+---------------------+---------------------+---------------------+
| |
| Latency p95 (line) Error rate (line) |
| |
+-----------------------------------------------------------------+
| |
| Throughput (area) Saturation (line) |
| |
+-----------------------------------------------------------------+
| |
| Recent events / alerts (events or table, time-sorted) |
| |
+-----------------------------------------------------------------+
Analytical deep-dive
- Audience: Analysts, investigators, capacity planners, data
scientists.
- Panel count: 10–14 panels — use tabs to keep any single tab
under 8.
- Canvas: 1920×1080 minimum, often scrollable vertically.
- Primary question: What caused this, and what does the data
show?
- Purpose: A guided exploration surface. The viewer expects to
pivot, filter, drill, and compare across multiple dimensions. They
spend 15+ minutes per session and tolerate higher density in
exchange for analytical depth.
Typical panel mix:
- Filter / parameter panel (inputs at top: time range, dimension
pickers, comparison toggles).
- Summary KPI strip with deltas vs. previous period.
- Time-series lines with comparison overlays.
- Distribution / breakdown (column, bar, histogram).
- Detail table with drilldown (the workhorse).
- Optional: scatter / bubble / parallelcoordinates / sankey for
correlation and flow analysis.
- Tabs split the surface: Overview / By region / By segment / Detail.
ASCII layout:
+-----------------------------------------------------------------+
| [Time range] [Dimension] [Compare] Inputs / parameters |
+-----------------------------------------------------------------+
| KPI w/ delta | KPI w/ delta | KPI w/ delta |
+-----------------------------------------------------------------+
| Tab: Overview | By region | By segment | Detail |
+-----------------------------------------------------------------+
| |
| Trend with comparison overlay (line) |
| |
+--------------------------------+--------------------------------+
| | |
| Distribution (column) | Correlation (scatter) |
| | |
+--------------------------------+--------------------------------+
| |
| Detail table (drilldown enabled) |
| |
+-----------------------------------------------------------------+
SOC overview
- Audience: SOC analysts (tier-1 triage, tier-2 investigation),
threat hunters.
- Panel count: 7–10 panels.
- Canvas: 1920×1080 wall display, often replicated to multiple
screens. Dark theme mandatory.
- Primary question: Where are threats, how severe, what just
happened?
- Purpose: A 24/7 vigilance surface. The viewer is on a multi-hour
shift watching for anomalies; the dashboard must be readable from
across the room and never strobe or distract.
Typical panel mix:
- Severity-coloured event count strip (critical / high / warning /
info — semantic palette).
- Geographic origin map (
splunk.map markers or
splunk.choropleth.svg).
- Top attackers / top targets / top techniques (sorted bars or
tables).
- MITRE ATT&CK heatmap or punchcard for technique frequency.
- Recent high-severity events feed (events viz, severity-coloured).
- Optional: link graph for entity relationships during investigation.
ASCII layout:
+---------+---------+---------+---------+---------+
| CRIT | HIGH | WARN | INFO | TOTAL |
| count | count | count | count | count |
+---------+---------+---------+---------+---------+
| \
| Geographic origin (map markers) |
| |
+-----------------------------+--------------------+
| | |
| Top attackers (bar) | ATT&CK heatmap |
| | |
+-----------------------------+--------------------+
| |
| Recent high-severity events (events viz, |
| severity-coloured rows) |
| |
+--------------------------------------------------+
SOC wall sub-archetype — dual-context default
The SOC overview is almost never deployed to a wall display only. The wall and the paired analyst console share the same dashboard definition — same JSON, same panels, same data sources. The wall is the always-on ambient surface; the console is the click-through investigation surface.
This means:
- Drilldowns are mandatory on every entity-displaying panel (host, IP, user, hash, severity bucket, geo location, MITRE technique-id). Zero visual cost on the wall (the wall ignores click handlers); critical value on the console (the analyst clicks through to investigate). "Wall display has no input device" is NOT a valid waiver for dropping drilldowns.
- Tabs add value, not subtract. The wall shows tab 1 (auto-cycle or static via deep-link); the console gets all of them (live threats, past trends, compliance posture, asset health). Never reflexively reject tabs because "SOC walls don't have tabs" — that guideline applies only to pure ambient walls without paired consoles, which is rare.
eventActions and row-level click handlers belong on every events-viz and table panel. Same logic as drilldowns: invisible on the wall, essential on the console.- Section header markdowns explain what each zone shows and where to escalate. New analyst on shift needs to read the dashboard cold; section headers carry that load.
- Footer with runbook + on-call link + Slack channel is mandatory for SOC archetypes. The wall doesn't read it; the console operator does.
The dashboard is dual-context by default. Authoring a SOC overview as if it's "wall only" is a Scope Check rejection — see ds-couture's Scope Check gate.
If a deployment is genuinely wall-only with no paired console (rare — confirm with the user before assuming), the interactivity affordances can be downgraded with explicit waivers. But the default is dual-context, not wall-only.
Hybrids and smells
When two archetypes blend in one dashboard:
-
Exec + analytical — usually a smell. The two have opposite
density tolerances. Exec wants 6–8 calm panels with one story;
analytical wants 10–14 with pivoting depth. If the user asks for a
"drill-down summary," pick analytical and add a small KPI strip on
top — not the other way around. An exec dashboard with a buried
detail table reads as cluttered to leadership and shallow to
analysts. Pick one master archetype and let the other show up as a
single supporting panel, not as a co-equal half.
-
Operational + SOC — common and OK; both expect dense grids,
status colours, dark theme, and 24/7 viewing. The fingerprint
differences are panel-mix (geo / severity / MITRE in SOC,
metric-time-series / capacity in ops). A combined NOC+SOC wall is a
legitimate pattern when one team owns both reliability and security
triage. Keep semantic colours consistent (critical = red, warning =
amber) and split the canvas into clear ops-zone vs. SOC-zone bands.
-
Exec + SOC — almost always wrong. Exec demands generous spacing
and one calm story; SOC demands density, parallel signals, and dark
theme. Leadership does not need a wall display, and SOC analysts do
not need quarterly KPIs. If asked for "an exec view of SOC," build a
small exec dashboard whose KPIs link out to the SOC dashboard via
drilldown — keep them as two surfaces.
-
Analytical + SOC — possible for tier-2 SOC investigation
consoles. Treat as analytical-with-severity-colouring rather than
trying to merge fingerprints: keep the analytical layout (inputs,
tabs, detail table, scatter / link graph) and apply the SOC dark
theme + semantic severity palette. The MITRE heatmap belongs on the
pure SOC overview, not on the investigation console.
Rule of thumb: if you cannot name the master archetype in one
word, the dashboard is probably trying to be two things at once. Split
it.
Audience-context expansion
For each archetype, four context dimensions shape every downstream
decision (colour, typography, density, drilldown depth):
| Dimension | Executive | Operational | Analytical | SOC |
|---|
| Viewing distance | ~50 cm (laptop) | ~70 cm (NOC monitor) | ~50 cm (laptop) | ~100 ft (wall) |
| Time-on-screen | 90 sec scan | 5–15 min check-in | 15+ min session | 8 h shift |
| Decision consequence | Quarterly review | On-call page / runbook | Multi-day investigation | Immediate response |
| Lighting | Mixed office | 24/7 dim NOC | Mixed office | Dark wall display |
How each dimension cascades:
- Viewing distance drives KPI font size and minimum panel
dimensions. SOC wall at 100 ft needs 56–72 px majors and 4×4 grid
cells minimum; exec at 50 cm tolerates 36–48 px.
- Time-on-screen drives information density. A 90-second exec
scan cannot afford >8 panels; an 8-hour SOC shift can absorb 10
parallel signals because the operator returns repeatedly.
- Decision consequence drives semantic colour weight. A red KPI
that pages an on-call must look unmistakably critical; a red KPI
that informs a quarterly review can be muted.
- Lighting drives theme choice. Dark NOC / SOC walls demand dark
theme with high-contrast semantic colours; mixed-lighting offices
default to light theme.
Use this table as a checklist when picking an archetype: if the
user's stated audience does not match the row's four dimensions, ask
again before committing.
