Dashboards & Visualizations

How can I refresh splunk search in a dashboard only one time after it is loaded?

Razziat
Explorer

I have a dashboard using a js script. The issue is that the js sctipt is loaded a the beginning. Because the method which using the $(document).ready is not working for an unknown reason, I had the idea to refresh the dashboard or just the search that is usig the js script. But the only solutions that I found are refreshing every X time. 
Is there a solution to refresh only one time a dashboard or just a search after the loading has ended ?
Thanks in advance !

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Would something like this work

<dashboard version="1.1">
  <label>Delayed</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| eval trigger=$trigger$
| fields - trigger
| eval message="Table loaded at ".strftime(now(),"%F %T")</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
  <row depends="$donotshow$">
    <panel>
      <table>
        <search>
          <query>| makeresults count=10000
| eval random=random()%100</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <done>
            <set token="trigger">go</set>
          </done>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</dashboard>

Essentially, the main search(es) will wait for a token to be defined, which is only defined when the search in the last panel (which I have hidden in this instance) has completed. The search in my last panel takes a little time just to demonstrate the effect.

0 Karma

Razziat
Explorer

As I undertstand your code, this gives the time between start of dashboard loading and end of search loading. I tried with mine using your code and It appears that it is done instantly. The problem here is that the js script is loaded before anything. Therefore, the code of the script is not applied on the search even though it is loaded instantly.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Bearing in mind that I am not an expert on javascript, but could you trigger your script on the basis of an input changing. You might be able to hide the input in a similar way using the depends attribute, as set the value of the input $form.token$ in the done handler for either a dummy search or indeed your main search?

Razziat
Explorer

I see what you have in mind. Unfortunately I don't think that it will work in my case. Also, it will be easier to create a button that can refresh a pannel by clicking on it. Or a button that rerun the js script load in the xml file.
If you have any other idea I will be happy to read it.
However thanks for your time.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...