Dashboards & Visualizations

How to display real-time data in a dashboard?

Hindoo
Path Finder

Hello,

I managed to display a dashboard for data in the last 24 hours or last week, but when I want to display real-time, it shows me "No results in current time range."
In short, I want to display a dashboard in real-time.
I need your help please !!!!!

Tags (2)

gyslainlatsa
Motivator

hi hindoo,
this is a code for one example of the dashboard real time

  <dashboard>
      <label>Realtime Search</label>
      <description>Table, Chart and Event panels powered by inline and report realtime searches.</description>
      <row>
        <table>
          <title>Inline Search Table</title>
          <search>
            <query>index=_internal | head 1000 | top limit=100 sourcetype | eval percent = round(percent,2)</query>
            <earliest>rt-30s</earliest>
            <latest>rt</latest>
          </search>
        </table>
        <chart>
          <title>Inline Search Chart</title>
          <search>
            <query>index=_internal | head 1000 | timechart count</query>
            <earliest>rt-30s</earliest>
            <latest>rt</latest>
          </search>
          <option name="charting.chart">area</option>
        </chart>
      </row>
  </dashboard>

use this time range rt-30s and rt in your dashboard and let me know.
for the last 24hrs, use this time range -24h@hand now

gyslainlatsa
Motivator

hi hindoo,

you said one source with source = "192.168.1.203",
it is likely that there is no result for this uique source in real time. try to select all sources with source = * and check if there will not always results. and if it works, you could create a dropdown where the user can select a particular source.

if you want to get all the results you have to write |top limit = 0, to generalize, you might have a code like this:

<form>
  <label>---------------------------------------</label>
  <description>---------------------</description>
  <fieldset autoRun="true" submitButton="false">
    <input type="dropdown" token="source" searchWhenChanged="true">
      <label>Select a source:</label>
      <default>*</default>
      <choice value="*">All</choice>
      <populatingSearch fieldForValue="source" fieldForLabel="source" >
        <![CDATA[sourcetype=syslog | stats count by source]]>
      </populatingSearch>
    </input>
  </fieldset>
  <row>

      <table>          
       <title>Inline Search Table</title> 
       <search>           
         <query> sourcetype= syslog source= $source$ | top limit=10</query>     
         <earliest>rt-30s</earliest>
         <latest>rt</latest>           
       </search>        
     </table> 

  </row>
</form>

please forgive my english.

0 Karma

Hindoo
Path Finder

thanks,
i try with your example:

Realtime Search

Table by inline and report realtime searches.

<table>          
  <title>Inline Search Table</title> 
  <search>           
    <query> sourcetype= syslog source="192.168.1.203" | top limit=10</query>     
    <earliest>rt-30s</earliest>
    <latest>rt</latest>           
  </search>        
</table>      

but , no result ...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...