Dashboards & Visualizations

Auto refresh a dashboard

bharpur183
Explorer

Is there any setting that I could enable for my entire dashboard to auto-refresh every couple of seconds or minutes ?

Tags (1)
0 Karma
1 Solution

niketn
Legend

You have multiple options.

If you are on Splunk 6.5 you can perform individual Panel refresh instead of the entire dashboard:

      <refresh>2m</refresh>
      <refreshType>delay</refreshType>
      <option name="refresh.display">preview</option>

Other options for "refresh.display" are - none and progressbar

With any version of Splunk, based on whether you have form or dashboard you can set refresh interval in seconds in the root node. For example in dashboard it will be

      <dashboard refresh="120">

Please also check whether you need real-time search with 2 min window or dashboard refresh or individual panel refresh every two minutes. Evaluate performance considerations for each scenario.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

Javip
Path Finder

We use that option in almost all of our dashboards, but when Splunk autorefresh (due to this parameter) we cannot analyze this action with a query like:

index=_internal sourcetype=splunkd_ui_access uri_path=/app/ user!="-" AppName= ViewName= ViewName!=contents ViewName!=search .......

We can monitor user navigation between dashboads, but nt refresh when they stay in a dashboard...
Any ideas to monitor these autorefresh actions?

Thanks a lot in advance.

0 Karma

niketn
Legend

You have multiple options.

If you are on Splunk 6.5 you can perform individual Panel refresh instead of the entire dashboard:

      <refresh>2m</refresh>
      <refreshType>delay</refreshType>
      <option name="refresh.display">preview</option>

Other options for "refresh.display" are - none and progressbar

With any version of Splunk, based on whether you have form or dashboard you can set refresh interval in seconds in the root node. For example in dashboard it will be

      <dashboard refresh="120">

Please also check whether you need real-time search with 2 min window or dashboard refresh or individual panel refresh every two minutes. Evaluate performance considerations for each scenario.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

bharpur183
Explorer

I added the above line right before the code but it gives out an error as:

Encountered the following error while trying to update: In handler 'views': Error parsing XML on line 355: Premature end of data in tag form line 1

DCHE DASHBOARD

0 Karma

niketn
Legend

As I had mentioned this is based on the type of view you are using... it will be either dashboard or form...in your case seems like you are using a form with inputs.

   <form refresh="120">
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

bharpur183
Explorer

but where in the xml does the above line go ?

wherever I enter it , it just errors out.
Sorry ,but am still new to splunk.

This is the first few lines of the code:

<form refresh="120">========================================>>>> ENTERED HERE ?
<input type="time" token="time_skip">
  <label></label>
  <default>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
  </default>
</input>


<panel>
  <title>NETWORK 1</title>
  <single>
    <title>Most Recent CIRCUIT HIT ID</title>
    <search>
      <query>sourcetype=almn netdevice!=null ifname=* DCNETWORK | eval fields=split(ifname," ") | eval ifname=mvindex(fields,1) |table _time netdevice ifname almn_msg | dedup netdevice ifname| lookup circuit_info.csv local_device as netdevice, local_port as ifname | search circuit_id!=null | fields _time netdevice ifname almn_msg span carrier circuit_type cloud remote_device remote_port local_node l_96csm_port remote_node r_96csm_port circuit_id | top circuit_id</query>
      <earliest>$time_skip.earliest$</earliest>
      <latest>$time_skip.latest$</latest>
    </search>
0 Karma

niketn
Legend

@bharpur183 Yes it should be the first line... Usually label and description follow after these and then the code starts like fieldsets with inputs and then row panel vizualizations etc.

Refer to following two documentation if you want to understand forms and Simple XML reference
https://docs.splunk.com/Documentation/Splunk/latest/Viz/Buildandeditforms
http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@bharpur183... Were you able to try as above?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

bharpur183
Explorer

@niketnilay Yes. I was finally able to get it working.
I was actually adding the above line on the first line as a new one like

But i realized later that the first need to go away and once I did that it worked like a charm.

Thanks for your help

0 Karma

woodcock
Esteemed Legend

Splunk Dashboards and Forms share a common set of attributes. If the intent is to refresh the entire page, you need to add the refresh attribute and indicate the interval in seconds.

For example, change your first line of XML to this to refresh every 30 seconds:

<dashboard refresh="30"> 

http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#Dashboards_and...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...