topic Re: Display Real Time Calculations Without a Search in Splunk Search

Display Real Time Calculations Without a Search

_dave_b — Fri, 30 Dec 2016 19:09:54 GMT

Hello,
I previously posted a question* about Real Time searches, and, thanks to the answers, I was able to achieve what I wanted with my dashboard. However, Real Time searches are expensive. Is there any way to continuously get the current (server) time and use it to perform calculations without performing a Real Time search?

* - Question located at http://answers.splunk.com/answers/484057/continuous-display-of-time-since-event.html

Thanks for your help!

Re: Display Real Time Calculations Without a Search

ddrillic — Fri, 30 Dec 2016 19:17:13 GMT

You should probably switch to alerts...

Re: Display Real Time Calculations Without a Search

niketn — Fri, 30 Dec 2016 20:12:18 GMT

Did you look at my answer for your previous post where you can use use historical search but refresh every periodic interval like 5 minutes? It was option 2 where you did not have to use Real Time Searches.

Re: Display Real Time Calculations Without a Search

gcusello — Tue, 29 Sep 2020 12:14:22 GMT

Hi _dave_b,
I I posted in the previous answer, you can also refresh your dashboard: from my experience,, this could be useful under two conditions:

if you're using this dashboard for a wallpaper and not for a static dashboard (it's less useful, if you're using a search dashboard, that the dashboard changes when you're see results!),
if your search isn't slow.

Otherwise, I think that real time searches are the most efficient way to display real time events.

Every way, you can to refresh your dashboard inserting in the <form> row the refresh time <form refresh="30"> (http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/PanelreferenceforSimplifiedXML#Dashboards_and_forms) or only one panel <option name="refresh.auto.interval">60</option>(http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML).

Bye.
Giuseppe