All Apps and Add-ons

How to automatically refresh searches?

haph
Path Finder

Hi,

we are beginning to test the Splunk Enterprise Dashboards App (Beta) at the moment and I want to create a dashboard which shows some temperatures from one of our production machines.
The temperatures should be refreshed every minute.

I see nowhere the option to refresh a search like in the XML Dashboards.

I already tried to copy from XML:

<refresh>30s</refresh>
 <refreshType>delay</refreshType>

to this:

"queryParameters": {
                    "earliest": "-1m@m",
                    "latest": "now",
                    "refresh": "5s",
                    "refreshType": "delay"
                }

It don't seem to work.

Is this feature already implemented or do I have to wait for it?

Thanks!

0 Karma
1 Solution

haph
Path Finder

I found it out myself.

The refresh and refreshType options don't belong within the queryParameters but within the options:

"ds_zHgNORf6": {
            "type": "ds.search",
            "options": {
                "query": "index=XXX source=XXX name=*EntfettenTemp* | eval value=value/10 | eval {name}=value | timechart avg(S5.Temperatur.EntfettenTempIst) as Ist span=20s | fields - _span _time | fillnull ",
                "queryParameters": {
                    "earliest": "-20m@m",
                    "latest": "now"
                },
                "refresh": "5s",
                "refreshType": "delay"
            },
            "name": "Search_1"
        },

View solution in original post

haph
Path Finder

I found it out myself.

The refresh and refreshType options don't belong within the queryParameters but within the options:

"ds_zHgNORf6": {
            "type": "ds.search",
            "options": {
                "query": "index=XXX source=XXX name=*EntfettenTemp* | eval value=value/10 | eval {name}=value | timechart avg(S5.Temperatur.EntfettenTempIst) as Ist span=20s | fields - _span _time | fillnull ",
                "queryParameters": {
                    "earliest": "-20m@m",
                    "latest": "now"
                },
                "refresh": "5s",
                "refreshType": "delay"
            },
            "name": "Search_1"
        },

sudoritz
Explorer

would be nice if they could extend that option GUI click in maybe the Data Source panel (like in core splunk panel) but awesome you found it in code 😉

SplunkWarlock
New Member

Thanks for the reply, this solution worked for me, mostly. I found that it doesn't seam to work for queries that are using dbconnect, e.g.: "| dbxquery query=\"\nSELECT *\nFROM ..... | stats count"

0 Karma

haph
Path Finder

I never used dbconnect so I can't say anything about it.

0 Karma

haph
Path Finder

I think (hope) they will. It is still the beta though.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...