All Apps and Add-ons

How to automatically refresh searches?

haph
Path Finder

Hi,

we are beginning to test the Splunk Enterprise Dashboards App (Beta) at the moment and I want to create a dashboard which shows some temperatures from one of our production machines.
The temperatures should be refreshed every minute.

I see nowhere the option to refresh a search like in the XML Dashboards.

I already tried to copy from XML:

<refresh>30s</refresh>
 <refreshType>delay</refreshType>

to this:

"queryParameters": {
                    "earliest": "-1m@m",
                    "latest": "now",
                    "refresh": "5s",
                    "refreshType": "delay"
                }

It don't seem to work.

Is this feature already implemented or do I have to wait for it?

Thanks!

0 Karma
1 Solution

haph
Path Finder

I found it out myself.

The refresh and refreshType options don't belong within the queryParameters but within the options:

"ds_zHgNORf6": {
            "type": "ds.search",
            "options": {
                "query": "index=XXX source=XXX name=*EntfettenTemp* | eval value=value/10 | eval {name}=value | timechart avg(S5.Temperatur.EntfettenTempIst) as Ist span=20s | fields - _span _time | fillnull ",
                "queryParameters": {
                    "earliest": "-20m@m",
                    "latest": "now"
                },
                "refresh": "5s",
                "refreshType": "delay"
            },
            "name": "Search_1"
        },

View solution in original post

haph
Path Finder

I found it out myself.

The refresh and refreshType options don't belong within the queryParameters but within the options:

"ds_zHgNORf6": {
            "type": "ds.search",
            "options": {
                "query": "index=XXX source=XXX name=*EntfettenTemp* | eval value=value/10 | eval {name}=value | timechart avg(S5.Temperatur.EntfettenTempIst) as Ist span=20s | fields - _span _time | fillnull ",
                "queryParameters": {
                    "earliest": "-20m@m",
                    "latest": "now"
                },
                "refresh": "5s",
                "refreshType": "delay"
            },
            "name": "Search_1"
        },

sudoritz
Explorer

would be nice if they could extend that option GUI click in maybe the Data Source panel (like in core splunk panel) but awesome you found it in code 😉

SplunkWarlock
New Member

Thanks for the reply, this solution worked for me, mostly. I found that it doesn't seam to work for queries that are using dbconnect, e.g.: "| dbxquery query=\"\nSELECT *\nFROM ..... | stats count"

0 Karma

haph
Path Finder

I never used dbconnect so I can't say anything about it.

0 Karma

haph
Path Finder

I think (hope) they will. It is still the beta though.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...