Autorefresh Postprocess & SavedSearch NOT working

koshyk — Mon, 28 Sep 2020 16:38:19 GMT

Hi folks
We got a requirement to auto-refresh the panels. The underlying search are "SavedSearch" results.
But I'm not able to get the Autorefresh-Postprocess-SavedSearch combo to work. I've also tried HiddenSavedSearch. Below snippet is what I did. Any ideas to get SavedSearch to be autorefreshed?

Sample_Internal_Search

index="_internal" earliest=-5m  | stats count by sourcetype, host

SideView SavedSearch - Part1

  <module name="AutoRefresh" layoutPanel="panel_row2_col1">
    <param name="refreshEvery">30</param>
        <module name="SavedSearch" layoutPanel="panel_row2_col1_grp1" autoRun="True">
          <param name="name">Sample_Internal_Search</param>
              <module name="HiddenPostProcess">
                <param name="search"> | stats sum(count) as INTERNALCOUNT</param>
                  <module name="HTML">
                    <param name="html"><![CDATA[
                      <h3>SavedSearch Internal events: $results[0].INTERNALCOUNT$</h3>
                    ]]></param>
                  </module>
              </module>
        </module>

Splunk Built-in HiddenSavedSearch - Part2

    <module name="HiddenSavedSearch" layoutPanel="panel_row2_col1_grp2" autoRun="True">
      <param name="savedSearch">Sample_Internal_Search</param>
          <module name="PostProcess">
            <param name="search"> | stats sum(count) as INTERNALCOUNT</param>
              <module name="HTML">
                <param name="html"><![CDATA[
                  <h3>HiddenSavedSearch Internal events: $results[0].INTERNALCOUNT$</h3>
                ]]></param>
              </module>
          </module>
    </module>

Normal Search - Part3

    <module name="Search" layoutPanel="panel_row2_col1_grp3" autoRun="True">
      <param name="search">index="_internal" earliest=-5m  | stats count by sourcetype, host</param>
          <module name="PostProcess">
            <param name="search"> | stats sum(count) as INTERNALCOUNT</param>
              <module name="HTML">
                <param name="html"><![CDATA[
                  <h3>Search Internal events: $results[0].INTERNALCOUNT$</h3>
                ]]></param>
              </module>
          </module>
    </module>
</module>

The normal Search (part3) of XML works perfectly. But the other two values never refreshes. But of course Part3 queries the system everytime per user !!

Re: Autorefresh Postprocess & SavedSearch NOT working

koshyk — Wed, 28 May 2014 13:11:25 GMT

at last found a way.. But let me explain what all things I tried first
- Tried: Splunk native autorefresh. It works, but only at "View/Dashboard" level (ie whole page refreshes)
- Tried: Sideviewutils . Couldn't make it to work with SavedSearch.
- Tried: used "|savedsearch mySavedSearchName | ..." . It works, but won't get benefit of savedsearch as it runs from scratch.

Working approaches
- used "loadjob" as per this example. It works, but a pain to migrate systems as the username/appnames won't be consistent.
- Best solution for me: Used DynamicHiddenSavedSearch module from "Dynamic Dashboard Panel Refresh" App. Link here . I have added the contents into /appserver/modules , restart splunk. In your advanced XML use:

 <module name="DynamicHiddenSavedSearch" layoutPanel="panel_row3_col1" autoRun="True">
              <param name="savedSearch">YourSavedSearchName</param>
              <param name="refreshInterval">60</param>

and voilaa!! it worked~!!

topic Autorefresh Postprocess & SavedSearch NOT working in Reporting

Autorefresh Postprocess & SavedSearch NOT working

Re: Autorefresh Postprocess & SavedSearch NOT working