Splunk Search

How can I stop results in dashboard from populating until the search has completed?

DPWSplunkPOC
Explorer

User's are sharing the data populated in the dashboard before search finishes running. I would like to stop Splunk from showing the results in a dashboard until the search has completed. Is this possible?

0 Karma

DalJeanis
Legend

I would probably display a "progress" indicator on the panel, then cause it to disappear when "done".

Exact method depends on exactly what you are returning. Look at the "done" element of the search, and the "rejects" element of the panel. Basically, have something that is listed in the rejects for the panel (for instance "WaitForSearch"), define (set) that something when the search launches and then undefine it (unset) when you reach the "done" for the search.

See the Search Event Handlers section of this page - http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/EventHandlerReference#Search_event_handlers

See also http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/tokens#Custom_logic_for_dashboard_eval_express...

0 Karma

kmccririe_splun
Splunk Employee
Splunk Employee
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...