How to automatically refresh searches?

[haph]

Hi,

we are beginning to test the Splunk Enterprise Dashboards App (Beta) at the moment and I want to create a dashboard which shows some temperatures from one of our production machines.
The temperatures should be refreshed every minute.

I see nowhere the option to refresh a search like in the XML Dashboards.

I already tried to copy from XML:

<refresh>30s</refresh>
 <refreshType>delay</refreshType>

to this:

"queryParameters": {
                    "earliest": "-1m@m",
                    "latest": "now",
                    "refresh": "5s",
                    "refreshType": "delay"
                }

It don't seem to work.

Is this feature already implemented or do I have to wait for it?

Thanks!

[haph · Accepted solution]

I found it out myself.

The refresh and refreshType options don't belong within the queryParameters but within the options:

"ds_zHgNORf6": {
            "type": "ds.search",
            "options": {
                "query": "index=XXX source=XXX name=*EntfettenTemp* | eval value=value/10 | eval {name}=value | timechart avg(S5.Temperatur.EntfettenTempIst) as Ist span=20s | fields - _span _time | fillnull ",
                "queryParameters": {
                    "earliest": "-20m@m",
                    "latest": "now"
                },
                "refresh": "5s",
                "refreshType": "delay"
            },
            "name": "Search_1"
        },

[sudoritz]

would be nice if they could extend that option GUI click in maybe the Data Source panel (like in core splunk panel) but awesome you found it in code 😉

[SplunkWarlock]

Thanks for the reply, this solution worked for me, mostly. I found that it doesn't seam to work for queries that are using dbconnect, e.g.: "| dbxquery query=\"\nSELECT *\nFROM ..... | stats count"

[haph]

I never used dbconnect so I can't say anything about it.

[haph]

I think (hope) they will. It is still the beta though.