topic define refresh interval for form/dashboard in Dashboards & Visualizations

define refresh interval for form/dashboard

rashid47010 — Thu, 29 Dec 2016 07:40:24 GMT

I have one dashboard with multiple panels(in line searches)
How can I change the refresh interval for my dashboard/form.

Re: define refresh interval for form/dashboard

gokadroid — Thu, 29 Dec 2016 07:49:22 GMT

It depends on the version of Splunk you are using. Since the latest version gives you the option to refresh the query within a panel then start from there:

<search>
     <query>
     </query>
     <earliest></earliest>
     <latest></latest>
     <sampleRatio></sampleRatio>
     <refresh>5m</refresh>
   </search>

Otherwise depending on the Splunk version following might work:

Form refresh:

<form refresh="30">

Dashboard refresh

<dashboard refresh="30">

Panel refresh

<option name="refresh.auto.interval">60</option>

Re: define refresh interval for form/dashboard

rashid47010 — Sun, 01 Jan 2017 19:28:06 GMT

hi
little confusing to me

I have on form, where I have three panels. each panel have query. I want to refresh all panels once.

I use form refresh query " " but it gives me error. my xml code is

xxx Dashboard
xxx

<input type="time" searchWhenChanged="true">
  <label>Search</label>
  <default>
    <earliest>@d</earliest>
    <latest>now</latest>
          </default>
</input>


<panel>
  <table>
    <title>Malware Found</title>
    <search>
      <query>index=xxx_sxx xxxxxxxx | stats values(vxxxn),values(file_namxxxx),values(Fiezzzh),values(A\\\\) by xxxx,xx,sigxxx</query>
    </search>
    <option name="wrap">true</option>
    <option name="rowNumbers">false</option>
    <option name="dataOverlayMode">none</option>
    <option name="drilldown">cell</option>
    <option name="count">10</option>
  </table>
</panel>


<panel>
  <table>
    <titlesssE</title>
    <search>
      <query>index=sss | eval est_time=strftime(_time, "%Y-%d-%m %H:%M") |stats values(ss) as "Action" ,values(ss1) as "sss",values(ssss),values(css) as URL,values(ssr) as "Source User",values(sssr) as "eeer",values(eert),values(eee),values(seec)  by eeee</query>
    </search>
    <option name="wrap">true</option>
    <option name="rowNumbers">false</option>
    <option name="dataOverlayMode">none</option>
    <option name="drilldown">cell</option>
    <option name="count">10</option>
  </table>
</panel>


<panel>
  <chart>

Re: define refresh interval for form/dashboard

avaishsplunk — Sun, 01 Jan 2017 19:45:15 GMT

I faced the same issue, create a  hidden panel on your dashboard and set the refresh interval as per your requirement for that panel, once that refreshes the entire dashboard will refresh, you will have to set the refresh interval individually for each query also

<panel>
      <single depends="$nothing$">
        <search id="abc">
          <query>"Put any of your queries here"
         </query>
         <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="refresh.auto.interval">60</option>
      </single>
  </panel>

Re: define refresh interval for form/dashboard

gokadroid — Mon, 02 Jan 2017 01:22:32 GMT

Here is a sample code of a dashobard which refreshes every 15 secs in Splunk 6.4.2 irrespective of however many panels it has. My example has three panels and doesn't need each query refresh but only <dashboard refresh="15"> at the top:

<dashboard refresh="15">
  <label>timer</label>
  <row>
    <panel>
      <table>
        <title>Panel 1</title>
        <search>
          <query>| makeresults | eval abc=relative_time(now(), "-1s") | table abc</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="wrap">undefined</option>
        <option name="rowNumbers">undefined</option>
        <option name="drilldown">row</option>
      </table>
    </panel>
    <panel>
      <table>
        <title>Panel 2</title>
        <search>
          <query>| makeresults | eval abc=relative_time(now(), "-2s") | table abc</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="wrap">undefined</option>
        <option name="rowNumbers">undefined</option>
        <option name="drilldown">row</option>
      </table>
    </panel>
    <panel>
      <table>
        <title>Panel 3</title>
        <search>
          <query>| makeresults | eval abc=relative_time(now(), "+1s") | table abc</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="wrap">undefined</option>
        <option name="rowNumbers">undefined</option>
        <option name="drilldown">row</option>
      </table>
    </panel>
  </row>
</dashboard>

If you happen to have <form>...</form> use it refresh="15" similarly like it is used in dashboard above <form refresh="15">...</form>

Same should work in 6.5.0.

Re: define refresh interval for form/dashboard

gokadroid — Mon, 02 Jan 2017 01:38:01 GMT

Which version of Splunk are you using. You might not need to refresh all the queries piecemeal and can refresh the entire dashboard every 15 secs. using refresh="15" . I have tried it on 6.4.2 and 6.5.0. See my comment above for sample code of how to make it work and see if that helps in your case.

Re: define refresh interval for form/dashboard

avaishsplunk — Mon, 02 Jan 2017 01:52:39 GMT

Hello Gokadroid,

This probably will work for dashboard, in my case it was a form this was the reason putting refresh in the top will not work.

Regards