Dashboards & Visualizations

Is it possible to add the runtime to each dashboard panel?

HeinzWaescher
Motivator

Hi,

is there an option to add the runtime of the search to the panel actions?

Thanks in advance

0 Karma

cmerriman
Super Champion

i don't believe so. it looks like these might be the only options:

http://docs.splunk.com/Documentation/Splunk/6.6.1/Viz/PanelreferenceforSimplifiedXML#Shared_options
export/inspect/open/refresh.

could be a good enhancement.

you can, however, create a token with $job.runDuration$ and that will give you the number of seconds that the search took to complete, and possibly display that in the panel description?
http://docs.splunk.com/Documentation/Splunk/6.6.1/Viz/tokens#Search_event_elements_and_job_propertie...

HeinzWaescher
Motivator

I'm not sure how this is supposed to look like. I would need a form dashboard and would not be able to use saved searches, right?

0 Karma

cmerriman
Super Champion

if you used saved searches, you can use the _audit index to grab the run duration and create the token from that. the search is something like index=_audit action=search savedsearch_name=* info=completed|stats sum(total_run_time) as runDuration by savedsearch_name _time

oh but sorry, yes, this would need to be inside of a dashboard, it wouldn't be visible in a report page.

HeinzWaescher
Motivator

that would mean to much effort 🙂 but thanks anyway!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...