All Apps and Add-ons

How to automatically refresh searches?

Path Finder

Hi,

we are beginning to test the Splunk Enterprise Dashboards App (Beta) at the moment and I want to create a dashboard which shows some temperatures from one of our production machines.
The temperatures should be refreshed every minute.

I see nowhere the option to refresh a search like in the XML Dashboards.

I already tried to copy from XML:

<refresh>30s</refresh>
 <refreshType>delay</refreshType>

to this:

"queryParameters": {
                    "earliest": "-1m@m",
                    "latest": "now",
                    "refresh": "5s",
                    "refreshType": "delay"
                }

It don't seem to work.

Is this feature already implemented or do I have to wait for it?

Thanks!

0 Karma
1 Solution

Path Finder

I found it out myself.

The refresh and refreshType options don't belong within the queryParameters but within the options:

"ds_zHgNORf6": {
            "type": "ds.search",
            "options": {
                "query": "index=XXX source=XXX name=*EntfettenTemp* | eval value=value/10 | eval {name}=value | timechart avg(S5.Temperatur.EntfettenTempIst) as Ist span=20s | fields - _span _time | fillnull ",
                "queryParameters": {
                    "earliest": "-20m@m",
                    "latest": "now"
                },
                "refresh": "5s",
                "refreshType": "delay"
            },
            "name": "Search_1"
        },

View solution in original post

Path Finder

I found it out myself.

The refresh and refreshType options don't belong within the queryParameters but within the options:

"ds_zHgNORf6": {
            "type": "ds.search",
            "options": {
                "query": "index=XXX source=XXX name=*EntfettenTemp* | eval value=value/10 | eval {name}=value | timechart avg(S5.Temperatur.EntfettenTempIst) as Ist span=20s | fields - _span _time | fillnull ",
                "queryParameters": {
                    "earliest": "-20m@m",
                    "latest": "now"
                },
                "refresh": "5s",
                "refreshType": "delay"
            },
            "name": "Search_1"
        },

View solution in original post

Explorer

would be nice if they could extend that option GUI click in maybe the Data Source panel (like in core splunk panel) but awesome you found it in code 😉

New Member

Thanks for the reply, this solution worked for me, mostly. I found that it doesn't seam to work for queries that are using dbconnect, e.g.: "| dbxquery query=\"\nSELECT *\nFROM ..... | stats count"

0 Karma

Path Finder

I never used dbconnect so I can't say anything about it.

0 Karma

Path Finder

I think (hope) they will. It is still the beta though.

0 Karma