topic Re: Realtime single value panel and live gauges not updating in Splunk Search

Realtime single value panel and live gauges not updating

phoenixdigital — Fri, 13 May 2011 00:49:50 GMT

So I have created some single values and gauges which I hope to update with live data. However they dont seem to update and there is new data coming in every 15 seconds.

Single Value


<single>
                <searchString>host="jacona" SPLUNK:ChkInpReg regName=GensetRPM | head 1 | rangemap field=val low=0-30000 severe=30000-100000 | fields val, range</searchString>
                <title>Station State</title>
                <option name="field">val</option>
                <option name="classField">range</option>
                <earliestTime>rt</earliestTime>
                <latestTime>rt</latestTime>

</single>

The Gauge Here


        <chart>
                <title>Station Output</title>
                <searchTemplate>host="jacona" SPLUNK:ChkInpReg regName=GensetRPM  | gauge val 0 10000 25000 33000</searchTemplate>
                <option name="charting.chart">radialGauge</option>
                <option name="charting.chart.rangeValues">[0,30,70,100]</option>
                <option name="charting.gaugeColors">[0xBF3030,0xFFE800,0x84E900]</option>
                <earliestTime>rt</earliestTime>
                <latestTime>rt</latestTime>
        </chart>

Anyone have any thoughts?

Re: Realtime single value panel and live gauges not updating

jflomenberg — Fri, 13 May 2011 15:55:32 GMT

Can you provide a sample log line and show us where you are setting 'val'?

Re: Realtime single value panel and live gauges not updating

phoenixdigital — Fri, 13 May 2011 21:40:43 GMT

Here is an example line

May 13 12:41:25 jacona power-engine[32525]: SPLUNK:ChkInpReg, regName=GensetRPM, reg=7, val=3668

Also just to mention these gauges and single values display fine when not attempting realtime.

Re: Realtime single value panel and live gauges not updating

hazekamp — Tue, 17 May 2011 20:42:34 GMT

I would recommend adjusting earliestTime values to create a real-time time window. This helps Splunk collect real-time events with drift between indextime and _time.

Try:

<earliestTime>rt-5m</earliestTime>
<latestTime>rt</latestTime>

Update:
Glad this worked. If you would like to always have the latest event consider adding the "head" command.

<your search> | head 1

Re: Realtime single value panel and live gauges not updating

phoenixdigital — Wed, 18 May 2011 01:10:40 GMT

Closer....

That displays the result thanks however the gauge never changes after that even though I know the data is incrementing every second and being logged every 15 seconds.

I watched it for about 10 minutes

Re: Realtime single value panel and live gauges not updating

phoenixdigital — Wed, 18 May 2011 01:27:47 GMT

Ignore that it is updating live now. Thanks heaps for your suggestion.

Another small question is there any way possible to have these 'realtime' gauges start with the most recent value in splunk instead of waiting for the first data point?

Also with 'realtime' charts can you have it show live data but start with the last 30 minutes?

Re: Realtime single value panel and live gauges not updating

jflomenberg — Thu, 19 May 2011 17:17:19 GMT

In 4.2 the only way you can do this is by scheduling the underlying search to run all the time in the background (step 2 in the add to dashboard workflow for rt search)