Hi,
we are beginning to test the Splunk Enterprise Dashboards App (Beta) at the moment and I want to create a dashboard which shows some temperatures from one of our production machines.
The temperatures should be refreshed every minute.
I see nowhere the option to refresh a search like in the XML Dashboards.
I already tried to copy from XML:
<refresh>30s</refresh>
<refreshType>delay</refreshType>
to this:
"queryParameters": {
"earliest": "-1m@m",
"latest": "now",
"refresh": "5s",
"refreshType": "delay"
}
It don't seem to work.
Is this feature already implemented or do I have to wait for it?
Thanks!
I found it out myself.
The refresh and refreshType options don't belong within the queryParameters but within the options:
"ds_zHgNORf6": {
"type": "ds.search",
"options": {
"query": "index=XXX source=XXX name=*EntfettenTemp* | eval value=value/10 | eval {name}=value | timechart avg(S5.Temperatur.EntfettenTempIst) as Ist span=20s | fields - _span _time | fillnull ",
"queryParameters": {
"earliest": "-20m@m",
"latest": "now"
},
"refresh": "5s",
"refreshType": "delay"
},
"name": "Search_1"
},
I found it out myself.
The refresh and refreshType options don't belong within the queryParameters but within the options:
"ds_zHgNORf6": {
"type": "ds.search",
"options": {
"query": "index=XXX source=XXX name=*EntfettenTemp* | eval value=value/10 | eval {name}=value | timechart avg(S5.Temperatur.EntfettenTempIst) as Ist span=20s | fields - _span _time | fillnull ",
"queryParameters": {
"earliest": "-20m@m",
"latest": "now"
},
"refresh": "5s",
"refreshType": "delay"
},
"name": "Search_1"
},
would be nice if they could extend that option GUI click in maybe the Data Source panel (like in core splunk panel) but awesome you found it in code 😉
Thanks for the reply, this solution worked for me, mostly. I found that it doesn't seam to work for queries that are using dbconnect, e.g.: "| dbxquery query=\"\nSELECT *\nFROM ..... | stats count"
I never used dbconnect so I can't say anything about it.
I think (hope) they will. It is still the beta though.