topic Re: Splunk Dashboard with auto refresh. in Dashboards & Visualizations

Splunk Dashboard with auto refresh.

nilaksh92 — Thu, 25 May 2017 08:26:26 GMT

Hi Everyone,

I am facing following issue.

I have a dashboard which is getting refreshed after every 30 seconds. In the same dashboard I have created drill down functionality.

Issue:- Whenever I am doing drill down. Suppose Now I am at second panel of drill down. But whenever dashboard refreshes the panel automatically does drill up.

But I don't want to drill up on dashboard refresh,

Please help me out to resolve this issue.

Thanks in advance
Nikks

Re: Splunk Dashboard with auto refresh.

somesoni2 — Thu, 25 May 2017 08:46:29 GMT

can you post your dashboard xml?

Re: Splunk Dashboard with auto refresh.

kamlesh_vaghela — Thu, 25 May 2017 09:43:50 GMT

Hi Nilaksh,

Can you please let me know, in your dashboard how many panels actually needs to be refreshed?? I think initial panels only needs to be refreshed.

If you are showing other panels which are not required to be refresh then refresh only those particular panels.

Can you please try below search pattern in initial panels of your dashboard??

<search>
          <query>  YOUR SEARCH </query>
          <earliest>-1h@m</earliest>
          <latest>now</latest>
          **<refresh>30s</refresh>
          <refreshType>delay</refreshType>**
        </search>

Re: Splunk Dashboard with auto refresh.

sravankaripe — Thu, 25 May 2017 14:36:47 GMT

Try this

If you can to refresh panel use this tag
<option name="refresh.auto.interval">30</option>

if you want to refresh whole dashboard
<form refresh="30">

Re: Splunk Dashboard with auto refresh.

nilaksh92 — Fri, 26 May 2017 07:32:44 GMT

Hi Kamlesh,

Data of all panels is getting refreshed after each 30 seconds.

For that I have made, 30s in all base searches.

Whenever I drill down to second panel if time crosses 30 seconds, the panel again comes back to panel 1.'

I want the panel should not come back to first panel even refresh time is over.

Thanks in advance.

Re: Splunk Dashboard with auto refresh.

kamlesh_vaghela — Fri, 26 May 2017 09:53:06 GMT

Hi Nilaksh,

I'm not sure how you are using base searches with auto refresh search.

But yes, I have tried with single base search and 2 level drill downs within 3 panels and It's working as your need. So please check below XML. Check token which used in panel's depends. I hope it will be useful to you.

<dashboard>
  <label>TestDM Dashboard</label>
  <search id="baseSearch">
    <query>index=_internal | table _time sourcetype source</query>
    <earliest>-1h@h</earliest>
    <latest>now</latest>
    <refresh>15s</refresh>
    <refreshType>delay</refreshType>
  </search>
  <row>
    <panel>
      <chart>
        <search base="baseSearch">
          <query>timechart count by sourcetype</query>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">all</option>
        <drilldown>
          <set token="clicked_value">$click.name2$</set>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel depends="$clicked_value$">
      <table>
        <title>$clicked_value$</title>
        <search base="baseSearch">
          <query>search sourcetype="$clicked_value$" | table _time sourcetype source</query>
        </search>
        <option name="drilldown">row</option>
        <drilldown>
          <set token="clicked_value2">$row.sourcetype$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$clicked_value2$">
      <title>$clicked_value2$</title>
      <chart>
        <search base="baseSearch">
          <query>search sourcetype="$clicked_value2$" |stats count by source</query>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</dashboard>

Re: Splunk Dashboard with auto refresh.

nilaksh92 — Fri, 26 May 2017 12:34:44 GMT

Hi Kamlesh,

Can you drill down to second or third panel for 15 seconds and please see whether it is going to first panel automatically or not?

I tried the same approach, but first panel use to come after the refresh irrespective of whether we are on second or third panel.

Thanks in advance.

Re: Splunk Dashboard with auto refresh.

nilaksh92 — Fri, 26 May 2017 12:39:47 GMT

It is similar to what Kamlesh has posted in below comment.

Re: Splunk Dashboard with auto refresh.

kamlesh_vaghela — Fri, 26 May 2017 12:43:21 GMT

Hi Nilaksh,

Yes, drilldown working fine for 2nd and 3rd panel.

Can I see your xml ? You can hide your query by replacing your search query with <<MY SEARCH>>.

Thanks
Kamlesh

Re: Splunk Dashboard with auto refresh.

nilaksh92 — Fri, 26 May 2017 12:54:13 GMT

Hi Kamlesh,

Here is xml of my base search.

<search id="nikks"> <query> ** <query>
<earliest> @d </earliest>
 <sampleRatio>1</sampleRatio>
<refresh>30s</refresh>
<refreshType>delay</refreshType>
 </search>

Re: Splunk Dashboard with auto refresh.

kamlesh_vaghela — Fri, 26 May 2017 12:59:46 GMT

Hi Nilaksh,
:)
I'm unable to see xml. Use "Code Sample" tool from toolbar to make it visible. 🙂

Can you please provide xml of basesearch as well as 2nd or 3rd panels?

Thanks
Kamlesh

Re: Splunk Dashboard with auto refresh.

nilaksh92 — Fri, 26 May 2017 13:09:37 GMT

Hi please find my second panel's xml

<panel depends="$abc$" rejects="$xyz$">
<table>
<search base="nikks">
<query> ** <query>
</search>
<option name="drilldown">cell</option>
<drilldown target="_blank">
<set token="xyz"></set>
<unset token="abc"></unset>
</drildown>
......

Re: Splunk Dashboard with auto refresh.

kamlesh_vaghela — Mon, 29 May 2017 06:11:54 GMT

Hi Nilaksh,

It's little delayed.

I have answered on a Splunk question where panel hide show is mainly concerned.

So can you please see my answer on below link??

https://answers.splunk.com/answers/527558/drill-down-and-drill-up-on-3-panels.html

Thanks
Kamlesh

Re: Splunk Dashboard with auto refresh.

nilaksh92 — Tue, 30 May 2017 06:32:25 GMT

Hi Kamlesh,

I have implemented in same way. But still facing same issue.

It is coming back to panel1 whenever refresh happens.

I am not able to find out what is the issue.

Are token values getting refreshed on auto refresh? Is that the case?

Re: Splunk Dashboard with auto refresh.

kamlesh_vaghela — Tue, 30 May 2017 06:58:53 GMT

Hi Nilaksh,
Can you please give me your full xml..??
Remove all your search...
I need to check see tokens only..

Thanks
Kamlesh