Updating Dashboards

[apalen]

Hey Splunkers,

I have a few dashboards I'm running that we want to update ever 2-5 minutes, but we don't want to utilize a real-time search.

These dashboards are being displayed on a monitor tv in a hallway. so no manually intervention is wanted. I have read other post that suggest i use XML, unfortunately i know nothing of XML.

here are the searches being run for each dashboard:

Dashboard 1:

index=pfe_os_messages sourcetype="log4j" | head 10000 | rex "(?i)(?P\w+\s+\w+\s+\w+\s+=\s+\w+\s+\w+)" | top 50 Users

Dashboard 2:

host=foo payment via manually entered card NOT "ConnectionProvider.java: 202" | rex field="_raw" "user/amt/invoice\s=\s(?[\w\d]{3,10})" | table myUser | top limit=25 myUser

Dashboard 3:

host=foo [search InvalidRequestException] | timechart count

Dashboard 4:

action = run_report | timechart count

Any input or direction on Best Practice would be amazing!

Thanks in advance!

[LukeMurphey]

There is a Splunk app called Slideshow that allows you display a set of dashboards on an interval. You could set it up with just the one view and it will refresh it automatically.

[jlord]

This may not work for you, but I needed to rotate between 5 dashboards with auto-refreshing. The solution I found was using a Chrome add-in (Revolver) that paused 2 minutes on each tab and did a refresh on load. The constant 2 minute refresh kept the session active so that there were no timeout issues. Lastly, we ran this in full screen mode. This solution works great for us.

Good Luck
J

[apalen]

Thanks for the suggestion! I figured out the XML command, i wanted to kick myself when i figured out how simple it was! haha

[MuS · Accepted solution]

Hi apalen,

you should do some reading of the docs about Create and edit dashboards via the UI and related pages.

Here comes an additional hint: http://docs.splunk.com/Documentation/Splunk/6.1.1/Viz/PanelreferenceforSimplifiedXML and search refresh or read here http://docs.splunk.com/Documentation/Splunk/6.1.1/AdvancedDev/AdvancedDashboard

cheers, MuS