Dashboards & Visualizations

Dynamic search results display

danillopavan
Communicator

Hello all,

I have one dashboard with 4 panels. Each panel has different element display like: single value, status indicator, gauge chart and hoeshoe meter. Just would like to know if there is any way to have dynamic behaviour in one of the panel to display differents search every 2 minutes for example keeping others panels without any modification - dont want to reload entire dashboard - just would like to update the view of 1 panel showing different search every 2 minutes. Is it possible?

Thanks and regards,
Danillo Pavan

Tags (1)
0 Karma

danillopavan
Communicator

Hello rphillips, many thanks for your prompt answer.

You answered 50% of my problem..many thanks! Other 50%: how I can use different search query for each change..i mean...lets suppose that I include refresh=120 seconds...In 10 min I would like to have 5 different results...in my case the result of the search will always return 5 lines...and i would like to show each result for each interval. 0-2 mins: result line 1, 2-4 mins: result line 2, 4-6 mins: result line 3, 6-8 mins: result line 4 and 8-10 mins: result line 5. Is it possible?

0 Karma

rphillips_splk
Splunk Employee
Splunk Employee

Here is an example dashboard with one panel that refreshes every 5 sec and the other panel with no refresh, which will refresh when the dashboard refreshes every 30sec

<dashboard refresh="30">
  <label></label>
  <row>
    <panel>
      <title>refresh panel every 5sec</title>
      <table>
        <search>
          <query>index=_internal | stats count by host</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <refresh>5</refresh>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>refresh panel with dashboard refresh every 30 sec</title>
      <table>
        <search>
          <query>index=_internal | stats count by host</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...