All Apps and Add-ons

Updating Dashboards

apalen
Path Finder

Hey Splunkers,

I have a few dashboards I'm running that we want to update ever 2-5 minutes, but we don't want to utilize a real-time search.

These dashboards are being displayed on a monitor tv in a hallway. so no manually intervention is wanted. I have read other post that suggest i use XML, unfortunately i know nothing of XML.

here are the searches being run for each dashboard:

Dashboard 1:

index=pfe_os_messages sourcetype="log4j" | head 10000 | rex "(?i)(?P\w+\s+\w+\s+\w+\s+=\s+\w+\s+\w+)" | top 50 Users

Dashboard 2:

host=foo payment via manually entered card NOT "ConnectionProvider.java: 202" | rex field="_raw" "user/amt/invoice\s=\s(?[\w\d]{3,10})" | table myUser | top limit=25 myUser

Dashboard 3:

host=foo [search InvalidRequestException] | timechart count

Dashboard 4:

action = run_report | timechart count

Any input or direction on Best Practice would be amazing!

Thanks in advance!

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi apalen,

you should do some reading of the docs about Create and edit dashboards via the UI and related pages.

Here comes an additional hint: http://docs.splunk.com/Documentation/Splunk/6.1.1/Viz/PanelreferenceforSimplifiedXML and search refresh or read here http://docs.splunk.com/Documentation/Splunk/6.1.1/AdvancedDev/AdvancedDashboard

cheers, MuS

View solution in original post

LukeMurphey
Champion

There is a Splunk app called Slideshow that allows you display a set of dashboards on an interval. You could set it up with just the one view and it will refresh it automatically.

jlord
Explorer

This may not work for you, but I needed to rotate between 5 dashboards with auto-refreshing. The solution I found was using a Chrome add-in (Revolver) that paused 2 minutes on each tab and did a refresh on load. The constant 2 minute refresh kept the session active so that there were no timeout issues. Lastly, we ran this in full screen mode. This solution works great for us.

Good Luck
J

apalen
Path Finder

Thanks for the suggestion! I figured out the XML command, i wanted to kick myself when i figured out how simple it was! haha

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi apalen,

you should do some reading of the docs about Create and edit dashboards via the UI and related pages.

Here comes an additional hint: http://docs.splunk.com/Documentation/Splunk/6.1.1/Viz/PanelreferenceforSimplifiedXML and search refresh or read here http://docs.splunk.com/Documentation/Splunk/6.1.1/AdvancedDev/AdvancedDashboard

cheers, MuS

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...