Dashboards & Visualizations

Can I display the status of a dashboard for when it is running/completed?

DPWSplunkPOC
Explorer

I have users that are using dashboards created in Splunk. Because Splunk will begin displaying results right away in the panels of the dashboard, the user's are taking the results before the searches in the panels finish. I know there is the blue bar at the top of each panel that provides the status of the search but the user's complain that it is too hard to see. Is there anyway that I can display a message that maybe says "running" and when the searches complete it says "completed"?

I would even accept a way for the panel to wait to display the result until the search is complete.

I'm currently using Splunk v6.3.4

0 Karma

rjthibod
Champion

Splunk 6.3 and newer allows you to monitor the status of each search via Simple XML. You cannot monitor the dashboard as a whole, just individual searches.

Here is a link that acts as the technical reference for these events: http://docs.splunk.com/Documentation/Splunk/6.3.4/Viz/EventHandlerReference#Search_event_handlers

Here is an example of how to monitor these events and display text before showing the results when the search completes. You can replicate this pattern for other panels/charts/tables. Just remember to use unique tokens names (i.e., you can only use the identifier "search_msg" once).

<panel>
  <title>Panel Title</title>
  <html depends="$search_msg$">
    <h3>$search_msg$</h3>
  </html>
  <chart rejects="$search_msg$">
    <search>
      <query>
        <YOUR SEARCH>
      </query>
      <preview>
        <set token="search_msg">Search is running</set>
      </preview>    
      <error>
        <set token="search_msg">Search encountered an error</set>
      </error>    
      <cancel>
        <set token="search_msg">Search was cancelled</set>
      </cancel>    
      <fail>
        <set token="search_msg">Search failed</set>
      </fail>
      <done>
        <unset token="search_msg"/>
      </done>
    </search>
    ...
  </chart>
</panel>
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...