Can I display the status of a dashboard for when i...

DPWSplunkPOC · ‎12-15-2016

I have users that are using dashboards created in Splunk. Because Splunk will begin displaying results right away in the panels of the dashboard, the user's are taking the results before the searches in the panels finish. I know there is the blue bar at the top of each panel that provides the status of the search but the user's complain that it is too hard to see. Is there anyway that I can display a message that maybe says "running" and when the searches complete it says "completed"?

I would even accept a way for the panel to wait to display the result until the search is complete.

I'm currently using Splunk v6.3.4

rjthibod · ‎12-15-2016

Splunk 6.3 and newer allows you to monitor the status of each search via Simple XML. You cannot monitor the dashboard as a whole, just individual searches.

Here is a link that acts as the technical reference for these events: http://docs.splunk.com/Documentation/Splunk/6.3.4/Viz/EventHandlerReference#Search_event_handlers

Here is an example of how to monitor these events and display text before showing the results when the search completes. You can replicate this pattern for other panels/charts/tables. Just remember to use unique tokens names (i.e., you can only use the identifier "search_msg" once).

<panel>
  <title>Panel Title</title>
  <html depends="$search_msg$">
    <h3>$search_msg$</h3>
  </html>
  <chart rejects="$search_msg$">
    <search>
      <query>
        <YOUR SEARCH>
      </query>
      <preview>
        <set token="search_msg">Search is running</set>
      </preview>    
      <error>
        <set token="search_msg">Search encountered an error</set>
      </error>    
      <cancel>
        <set token="search_msg">Search was cancelled</set>
      </cancel>    
      <fail>
        <set token="search_msg">Search failed</set>
      </fail>
      <done>
        <unset token="search_msg"/>
      </done>
    </search>
    ...
  </chart>
</panel>

Can I display the status of a dashboard for when it is running/completed?

Routing logs with Splunk OTel Collector for Kubernetes

Welcome to the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM