Dashboards & Visualizations

Can I display the status of a dashboard for when it is running/completed?

DPWSplunkPOC
Explorer

I have users that are using dashboards created in Splunk. Because Splunk will begin displaying results right away in the panels of the dashboard, the user's are taking the results before the searches in the panels finish. I know there is the blue bar at the top of each panel that provides the status of the search but the user's complain that it is too hard to see. Is there anyway that I can display a message that maybe says "running" and when the searches complete it says "completed"?

I would even accept a way for the panel to wait to display the result until the search is complete.

I'm currently using Splunk v6.3.4

0 Karma

rjthibod
Champion

Splunk 6.3 and newer allows you to monitor the status of each search via Simple XML. You cannot monitor the dashboard as a whole, just individual searches.

Here is a link that acts as the technical reference for these events: http://docs.splunk.com/Documentation/Splunk/6.3.4/Viz/EventHandlerReference#Search_event_handlers

Here is an example of how to monitor these events and display text before showing the results when the search completes. You can replicate this pattern for other panels/charts/tables. Just remember to use unique tokens names (i.e., you can only use the identifier "search_msg" once).

<panel>
  <title>Panel Title</title>
  <html depends="$search_msg$">
    <h3>$search_msg$</h3>
  </html>
  <chart rejects="$search_msg$">
    <search>
      <query>
        <YOUR SEARCH>
      </query>
      <preview>
        <set token="search_msg">Search is running</set>
      </preview>    
      <error>
        <set token="search_msg">Search encountered an error</set>
      </error>    
      <cancel>
        <set token="search_msg">Search was cancelled</set>
      </cancel>    
      <fail>
        <set token="search_msg">Search failed</set>
      </fail>
      <done>
        <unset token="search_msg"/>
      </done>
    </search>
    ...
  </chart>
</panel>
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...