<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Real time dashboard in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Real-time-dashboard/m-p/94944#M5183</link>
    <description>&lt;P&gt;Seems the problem was in the savedsearch. Just be replacing my search by this made it work:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;[NBsummary_CountJobs]
displayview = flashtimeline
search = index="netbackup" sourcetype="Netbackup" host=$host$ | stats latest(_time) |convert timeformat="%b %d (%a),   %H:%M:%S" ctime(latest(_time))  as Date | table Date

[NBsummary_CountJobsFirst]
displayview = flashtimeline
search =  index="netbackup" sourcetype="Netbackup" host=$host$ | stats earliest(_time) |convert timeformat="%b %d (%a),   %H:%M:%S" ctime(earliest(_time))  as Date | table Date
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Cant manage thought to understand the problem with head and tail that returned weird results.&lt;/P&gt;</description>
    <pubDate>Wed, 17 Jul 2013 14:24:26 GMT</pubDate>
    <dc:creator>timmalos</dc:creator>
    <dc:date>2013-07-17T14:24:26Z</dc:date>
    <item>
      <title>Real time dashboard</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Real-time-dashboard/m-p/94943#M5182</link>
      <description>&lt;P&gt;Hi&lt;BR /&gt;
I'm trying to make my dashboard Real-time refreshed but still got issues.&lt;BR /&gt;
A simply xml like this dosnt make my singleValue refreshed in real time.&lt;BR /&gt;
Do i do something wrong?&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt; &amp;lt;view isVisible="true"  template="dashboard.html"&amp;gt;
&amp;lt;label&amp;gt;Monitoring&amp;lt;/label&amp;gt;
&amp;lt;module name="AccountBar" layoutPanel="appHeader"/&amp;gt;
&amp;lt;module name="AppBar" layoutPanel="navigationHeader"/&amp;gt;
&amp;lt;module name="DashboardTitleBar" layoutPanel="viewHeader"/&amp;gt;
&amp;lt;module name="Message" layoutPanel="navigationHeader"&amp;gt;
    &amp;lt;param name="filter"&amp;gt;*&amp;lt;/param&amp;gt;
    &amp;lt;param name="maxSize"&amp;gt;1&amp;lt;/param&amp;gt;
    &amp;lt;param name="clearOnJobDispatch"&amp;gt;True&amp;lt;/param&amp;gt;
    &amp;lt;param name="level"&amp;gt;warn&amp;lt;/param&amp;gt;
&amp;lt;/module&amp;gt;
&amp;lt;!-- HiddenSearch R2C1 --&amp;gt;
&amp;lt;module name="HiddenSavedSearch" layoutPanel="panel_row2_col1" group="Last client backed up" autoRun="True"&amp;gt;
    &amp;lt;param name="savedSearch"&amp;gt;CountJobs&amp;lt;/param&amp;gt;
    &amp;lt;module name="EnablePreview"&amp;gt;
        &amp;lt;param name="enable"&amp;gt;True&amp;lt;/param&amp;gt;
        &amp;lt;param name="display"&amp;gt;False&amp;lt;/param&amp;gt;
        &amp;lt;module name="HiddenFieldPicker"&amp;gt;

            &amp;lt;module name="SingleValue"&amp;gt;&amp;lt;/module&amp;gt;
        &amp;lt;/module&amp;gt;
    &amp;lt;/module&amp;gt;       
&amp;lt;/module&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;My Countjob (Display the last event indexed)saved search is : &lt;BR /&gt;
&lt;CODE&gt;sourcetype="CSVCOMPLETE" | head 1|convert timeformat="%b %d (%a),   %H:%M:%S" ctime(_time)  as Date |eval output = toString(Client) + "  the " + toString(Date)|table output&lt;/CODE&gt;&lt;/P&gt;

&lt;P&gt;Start time : rt-1h@m&lt;BR /&gt;
Finish time : rt&lt;/P&gt;

&lt;P&gt;Thx for your help !&lt;/P&gt;</description>
      <pubDate>Mon, 15 Jul 2013 08:52:39 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Real-time-dashboard/m-p/94943#M5182</guid>
      <dc:creator>timmalos</dc:creator>
      <dc:date>2013-07-15T08:52:39Z</dc:date>
    </item>
    <item>
      <title>Re: Real time dashboard</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Real-time-dashboard/m-p/94944#M5183</link>
      <description>&lt;P&gt;Seems the problem was in the savedsearch. Just be replacing my search by this made it work:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;[NBsummary_CountJobs]
displayview = flashtimeline
search = index="netbackup" sourcetype="Netbackup" host=$host$ | stats latest(_time) |convert timeformat="%b %d (%a),   %H:%M:%S" ctime(latest(_time))  as Date | table Date

[NBsummary_CountJobsFirst]
displayview = flashtimeline
search =  index="netbackup" sourcetype="Netbackup" host=$host$ | stats earliest(_time) |convert timeformat="%b %d (%a),   %H:%M:%S" ctime(earliest(_time))  as Date | table Date
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Cant manage thought to understand the problem with head and tail that returned weird results.&lt;/P&gt;</description>
      <pubDate>Wed, 17 Jul 2013 14:24:26 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Real-time-dashboard/m-p/94944#M5183</guid>
      <dc:creator>timmalos</dc:creator>
      <dc:date>2013-07-17T14:24:26Z</dc:date>
    </item>
  </channel>
</rss>

