All Apps and Add-ons

Updating Dashboards

apalen
Path Finder

Hey Splunkers,

I have a few dashboards I'm running that we want to update ever 2-5 minutes, but we don't want to utilize a real-time search.

These dashboards are being displayed on a monitor tv in a hallway. so no manually intervention is wanted. I have read other post that suggest i use XML, unfortunately i know nothing of XML.

here are the searches being run for each dashboard:

Dashboard 1:

index=pfe_os_messages sourcetype="log4j" | head 10000 | rex "(?i)(?P\w+\s+\w+\s+\w+\s+=\s+\w+\s+\w+)" | top 50 Users

Dashboard 2:

host=foo payment via manually entered card NOT "ConnectionProvider.java: 202" | rex field="_raw" "user/amt/invoice\s=\s(?[\w\d]{3,10})" | table myUser | top limit=25 myUser

Dashboard 3:

host=foo [search InvalidRequestException] | timechart count

Dashboard 4:

action = run_report | timechart count

Any input or direction on Best Practice would be amazing!

Thanks in advance!

0 Karma
1 Solution

MuS
Legend

Hi apalen,

you should do some reading of the docs about Create and edit dashboards via the UI and related pages.

Here comes an additional hint: http://docs.splunk.com/Documentation/Splunk/6.1.1/Viz/PanelreferenceforSimplifiedXML and search refresh or read here http://docs.splunk.com/Documentation/Splunk/6.1.1/AdvancedDev/AdvancedDashboard

cheers, MuS

View solution in original post

LukeMurphey
Champion

There is a Splunk app called Slideshow that allows you display a set of dashboards on an interval. You could set it up with just the one view and it will refresh it automatically.

jlord
Explorer

This may not work for you, but I needed to rotate between 5 dashboards with auto-refreshing. The solution I found was using a Chrome add-in (Revolver) that paused 2 minutes on each tab and did a refresh on load. The constant 2 minute refresh kept the session active so that there were no timeout issues. Lastly, we ran this in full screen mode. This solution works great for us.

Good Luck
J

apalen
Path Finder

Thanks for the suggestion! I figured out the XML command, i wanted to kick myself when i figured out how simple it was! haha

0 Karma

MuS
Legend

Hi apalen,

you should do some reading of the docs about Create and edit dashboards via the UI and related pages.

Here comes an additional hint: http://docs.splunk.com/Documentation/Splunk/6.1.1/Viz/PanelreferenceforSimplifiedXML and search refresh or read here http://docs.splunk.com/Documentation/Splunk/6.1.1/AdvancedDev/AdvancedDashboard

cheers, MuS

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...