Auto refresh a dashboard

[bharpur183]

Is there any setting that I could enable for my entire dashboard to auto-refresh every couple of seconds or minutes ?

[Javip]

We use that option in almost all of our dashboards, but when Splunk autorefresh (due to this parameter) we cannot analyze this action with a query like:

index=_internal sourcetype=splunkd_ui_access uri_path=/app/ user!="-" AppName= ViewName= ViewName!=contents ViewName!=search .......

We can monitor user navigation between dashboads, but nt refresh when they stay in a dashboard...
Any ideas to monitor these autorefresh actions?

Thanks a lot in advance.

[niketn · Accepted solution]

You have multiple options.

If you are on Splunk 6.5 you can perform individual Panel refresh instead of the entire dashboard:

      <refresh>2m</refresh>
      <refreshType>delay</refreshType>
      <option name="refresh.display">preview</option>

Other options for "refresh.display" are - none and progressbar

With any version of Splunk, based on whether you have form or dashboard you can set refresh interval in seconds in the root node. For example in dashboard it will be

      <dashboard refresh="120">

Please also check whether you need real-time search with 2 min window or dashboard refresh or individual panel refresh every two minutes. Evaluate performance considerations for each scenario.

[bharpur183]

I added the above line right before the code but it gives out an error as:

Encountered the following error while trying to update: In handler 'views': Error parsing XML on line 355: Premature end of data in tag form line 1

DCHE DASHBOARD

[niketn]

As I had mentioned this is based on the type of view you are using... it will be either dashboard or form...in your case seems like you are using a form with inputs.

   <form refresh="120">

[bharpur183]

but where in the xml does the above line go ?

wherever I enter it , it just errors out.
Sorry ,but am still new to splunk.

This is the first few lines of the code:

<form refresh="120">========================================>>>> ENTERED HERE ?
<input type="time" token="time_skip">
  <label></label>
  <default>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
  </default>
</input>


<panel>
  <title>NETWORK 1</title>
  <single>
    <title>Most Recent CIRCUIT HIT ID</title>
    <search>
      <query>sourcetype=almn netdevice!=null ifname=* DCNETWORK | eval fields=split(ifname," ") | eval ifname=mvindex(fields,1) |table _time netdevice ifname almn_msg | dedup netdevice ifname| lookup circuit_info.csv local_device as netdevice, local_port as ifname | search circuit_id!=null | fields _time netdevice ifname almn_msg span carrier circuit_type cloud remote_device remote_port local_node l_96csm_port remote_node r_96csm_port circuit_id | top circuit_id</query>
      <earliest>$time_skip.earliest$</earliest>
      <latest>$time_skip.latest$</latest>
    </search>

[niketn]

@bharpur183 Yes it should be the first line... Usually label and description follow after these and then the code starts like fieldsets with inputs and then row panel vizualizations etc.

Refer to following two documentation if you want to understand forms and Simple XML reference
https://docs.splunk.com/Documentation/Splunk/latest/Viz/Buildandeditforms
http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML

[niketn]

@bharpur183... Were you able to try as above?

[bharpur183]

@niketnilay Yes. I was finally able to get it working.
I was actually adding the above line on the first line as a new one like

But i realized later that the first need to go away and once I did that it worked like a charm.

Thanks for your help

[woodcock]

Splunk Dashboards and Forms share a common set of attributes. If the intent is to refresh the entire page, you need to add the refresh attribute and indicate the interval in seconds.

For example, change your first line of XML to this to refresh every 30 seconds:

<dashboard refresh="30"> 

http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#Dashboards_and...