Dashboards & Visualizations

Can I display the status of a dashboard for when it is running/completed?

DPWSplunkPOC
Explorer

I have users that are using dashboards created in Splunk. Because Splunk will begin displaying results right away in the panels of the dashboard, the user's are taking the results before the searches in the panels finish. I know there is the blue bar at the top of each panel that provides the status of the search but the user's complain that it is too hard to see. Is there anyway that I can display a message that maybe says "running" and when the searches complete it says "completed"?

I would even accept a way for the panel to wait to display the result until the search is complete.

I'm currently using Splunk v6.3.4

0 Karma

rjthibod
Champion

Splunk 6.3 and newer allows you to monitor the status of each search via Simple XML. You cannot monitor the dashboard as a whole, just individual searches.

Here is a link that acts as the technical reference for these events: http://docs.splunk.com/Documentation/Splunk/6.3.4/Viz/EventHandlerReference#Search_event_handlers

Here is an example of how to monitor these events and display text before showing the results when the search completes. You can replicate this pattern for other panels/charts/tables. Just remember to use unique tokens names (i.e., you can only use the identifier "search_msg" once).

<panel>
  <title>Panel Title</title>
  <html depends="$search_msg$">
    <h3>$search_msg$</h3>
  </html>
  <chart rejects="$search_msg$">
    <search>
      <query>
        <YOUR SEARCH>
      </query>
      <preview>
        <set token="search_msg">Search is running</set>
      </preview>    
      <error>
        <set token="search_msg">Search encountered an error</set>
      </error>    
      <cancel>
        <set token="search_msg">Search was cancelled</set>
      </cancel>    
      <fail>
        <set token="search_msg">Search failed</set>
      </fail>
      <done>
        <unset token="search_msg"/>
      </done>
    </search>
    ...
  </chart>
</panel>
Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...