Monitor data from Unix|*Nix TA in real-time?

[bdruth]

This seems like a really stupid question, but I haven't found any information on it here or in SplunkBase. Using the Unix|*Nix TA with Universal Forwarders, is it possible to have the built-in dashboards update in real-time? I'm finding that they only update when I refresh the page. Looking for a simple way to monitor the system health while the QA folks are running load tests on a set of new servers that we've stood up.

Thanks!

[martin_mueller]

You can modify the existing dashboards to either

• refresh the entire dashboard by setting the refresh attribute on the dashboard or form tag: http://docs.splunk.com/Documentation/Splunk/6.2.2/Viz/PanelreferenceforSimplifiedXML#dashboard
• refresh individual panels by setting the refresh.auto.interval option inside the chart tag: http://docs.splunk.com/Documentation/Splunk/6.2.2/Viz/PanelreferenceforSimplifiedXML#chart
• actually run real-time searches

If you're happy with one or two minute refresh rates then do one of the first two as described in the docs.

[dolivasoh]

It'd be pretty expensive to do indexing and throughput wise but you could set your input intervals very low, like 1-10 seconds. Deploy the new inputs to your forwarders during your QA and then run real-time searches on the data coming in. Anything you don't need to monitor with that much granularity afterwards should be adjusted back to a longer interval.

[bdruth]

Hey - thanks for the response - I'm not caring so much about the interval - it could refresh every minute or two for all I care, but the built-in dashboards don't seem to update themselves at all - unless I reload the view.