Splunk Search

Can't get tag to work

madkins23
New Member

I have a dashboard with several prebuilt panels and several non-prebuilt panels.

At the top of the form I have:

<input type="dropdown" token="refresh" searchWhenChanged="true">
  <label>Refresh</label>
  <choice value="60">1 minute</choice>
  <choice value="300">5 minutes</choice>
  <choice value="600">10 minutes</choice>
  <choice value="900">15 minutes</choice>
  <choice value="0">Never</choice>
  <default>Never</default>
</input>

For the value attribute I have tried integers (as above) and SPL time formats (e.g. 5m).

Within various searches in both prebuilt and non-prebuilt panels I have added:

  <refresh>$refresh$</refresh>
</search>

shown in several online postings as well as the documentation for our version of Splunk: 6.6.2, build 4b804538c686.

Nothing I have tried seems to work as I expect. The prebuilt panels run once and stop. The non-prebuilt panels refresh every minute. I think (it's a little hard to tell by hovering over the little controls).

Am I doing something wrong here? I have other dropdowns on the page that work, and the variables defined by those dropdowns interpolate in the prebuilt panels. If I add $refresh$ to a panel title it shows up just as I expect.

As far as I can tell the tag does not work, or at least it does not work as I expect. I have tried constants in it and they don't seem to change anything. Then once in a while it surprises me in some non-reproducible way.

Can someone tell me what I'm doing wrong?

0 Karma

niketn
Legend

@madkins23, seems like you missed adding s for seconds in all the choices. Like 1 minute = 60s. Following run anywhere dashboard works fine for me. Also I changed Never to empty value rather than a number.

<form>
  <label>Dynamic Refresh</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="refresh" searchWhenChanged="true">
      <label>Refresh</label>
      <choice value="60s">1 minute</choice>
      <choice value="300s">5 minutes</choice>
      <choice value="600s">10 minutes</choice>
      <choice value="900s">15 minutes</choice>
      <choice value="">Never</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <search>
          <query>index=_internal sourcetype=splunkd
          | timechart count</query>
          <earliest>-24h</earliest>
          <latest>now</latest>
          <refresh>$refresh$</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="drilldown">all</option>
        <option name="refresh.display">progressbar</option>
      </single>
    </panel>
  </row>
</form>

Also if your intent is to control the refresh of entire dashboard you can do the same with JavaScript by coding form refresh time.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...