Dashboards & Visualizations

Can I display the status of a dashboard for when it is running/completed?

DPWSplunkPOC
Explorer

I have users that are using dashboards created in Splunk. Because Splunk will begin displaying results right away in the panels of the dashboard, the user's are taking the results before the searches in the panels finish. I know there is the blue bar at the top of each panel that provides the status of the search but the user's complain that it is too hard to see. Is there anyway that I can display a message that maybe says "running" and when the searches complete it says "completed"?

I would even accept a way for the panel to wait to display the result until the search is complete.

I'm currently using Splunk v6.3.4

0 Karma

rjthibod
Champion

Splunk 6.3 and newer allows you to monitor the status of each search via Simple XML. You cannot monitor the dashboard as a whole, just individual searches.

Here is a link that acts as the technical reference for these events: http://docs.splunk.com/Documentation/Splunk/6.3.4/Viz/EventHandlerReference#Search_event_handlers

Here is an example of how to monitor these events and display text before showing the results when the search completes. You can replicate this pattern for other panels/charts/tables. Just remember to use unique tokens names (i.e., you can only use the identifier "search_msg" once).

<panel>
  <title>Panel Title</title>
  <html depends="$search_msg$">
    <h3>$search_msg$</h3>
  </html>
  <chart rejects="$search_msg$">
    <search>
      <query>
        <YOUR SEARCH>
      </query>
      <preview>
        <set token="search_msg">Search is running</set>
      </preview>    
      <error>
        <set token="search_msg">Search encountered an error</set>
      </error>    
      <cancel>
        <set token="search_msg">Search was cancelled</set>
      </cancel>    
      <fail>
        <set token="search_msg">Search failed</set>
      </fail>
      <done>
        <unset token="search_msg"/>
      </done>
    </search>
    ...
  </chart>
</panel>
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...