Hi,
is there an option to add the runtime of the search to the panel actions?
Thanks in advance
i don't believe so. it looks like these might be the only options:
http://docs.splunk.com/Documentation/Splunk/6.6.1/Viz/PanelreferenceforSimplifiedXML#Shared_options
export/inspect/open/refresh.
could be a good enhancement.
you can, however, create a token with $job.runDuration$
and that will give you the number of seconds that the search took to complete, and possibly display that in the panel description?
http://docs.splunk.com/Documentation/Splunk/6.6.1/Viz/tokens#Search_event_elements_and_job_propertie...
I'm not sure how this is supposed to look like. I would need a form dashboard and would not be able to use saved searches, right?
if you used saved searches, you can use the _audit index to grab the run duration and create the token from that. the search is something like index=_audit action=search savedsearch_name=* info=completed|stats sum(total_run_time) as runDuration by savedsearch_name _time
oh but sorry, yes, this would need to be inside of a dashboard, it wouldn't be visible in a report page.
that would mean to much effort 🙂 but thanks anyway!