Here's my scenario. I have a panel on a Splunk dashboard that displays a count of the number of people who buy eggs at a store.
I'm trying to find a way to update the data displayed on that panel without (a) refreshing the entire page or (b) refreshing the individual panel. Both of these methods regather that data even if there are no changes made to the data.
Is there a way to append data to a dahsboard without having to fully refresh?
You can add refresh parameter in search itself. Refer below example:
<search>
<query>panel_query</query>
<earliest>0</earliest>
<latest></latest>
<sampleRatio>1</sampleRatio>
<refresh>30s</refresh>
</search>