How do I get my panels to reflect updated results after every auto refresh?

[kenth213]

I've got a dashboard which runs a saved search called healthforms which has a cron schedule to run every 5 minutes:

<search id="healthforms">
    <query>| savedsearch healthforms</query>
</search>

I then have several panels which perform some post processing from the base search e.g:

<search base="healthforms">
       <query>| search blah....</query>
</search>

I auto refresh the panels every 5 minutes. However, the results stay the same.

How do I get the latest set of results automatically every 5 minutes for the scheduled saved search? (i.e. rerun the saved search in the dashboard automatically every 5mins) and also ensure that the postprocessing search panels run off the latest results to ensure that when the panels refresh, they have the latest updated results - without someone needing to manually refresh the dashboard.

EDIT: To clarify I don't want to refresh the ENTIRE dashboard (i.e. not <dashboard refresh="###">) but achieve the above and only have to refresh individual panels if possible.

Cheers

[kenth213 · Accepted solution]

I managed to figure this out. Inspired by this I used loadjob on each panel search to bring up the latest results and search off them. Now when each panel refreshes it brings back the latest results and performs the post search off them:

<search>
      <query>| loadjob savedsearch="user:app:savedsearch" |my post search here</query>
</search>

[Lucas_K]

You can refesh individual panel elements using a simplexml option.

Edit the source and put in the following line as a new option line inside your chart tags.

  <option name="refresh.auto.interval">60</option>

The above will refresh that individual panel every 60 seconds. Adjust the number as required.
I normally try and have it update more often than the search runs. This way it should have the latest results possible. Due to the underlying search taking time to run it can be hard to get these synced. As the refresh is near instant I found 1/2 the scheduled time worked fine. ie. update every 5 mins for a job that ran every 10 mins.

As for the searches themselves I believe you need to use a ref to the savedsearch.

   <search ref="mySavedSearch"></search>

If you add an id to it can be referenced from other parts of the dashboard.

<search id="globalSearch" ref="mySavedSearch"/>

You should be able to add post processing to the referenced search to filter those results from the previously run scheduled search.

<search id="globalSearch" ref="mySavedSearch"/>
<query>search sourcetype=splunkd</query>

[kenth213]

My search results still seem to be staying static, rather than using the latest instance of the saved search results for post processing.

The panels refresh but the post processing searches dont rerun to generate latest results

[Lucas_K]

Check and see if your saved search schedule is running.

Double check by removing the post process query part and just having the panel refer directly to the ref to the search. If that still doesn't work there is an issue with the scheduled search.

When the panel refreshes does it put up a loading bar or is it instant? If its instant then its using the previously run searches results and not running it at the time of the refresh (which is what you want).