Dashboards & Visualizations

How start a dashboard search based on a token and a time delay of n seconds



when I run a dashboard search, I'm writing an event to an index=test with the collect command. When this search is finished, it sets a token which is used to start a second search. This second is visualizing events from the index=test and should show the latest collected event when it runs.
Basically it works, but sometimes the seconds search does not recognize the latest event from index=test. I assume the second search starts to close after the collect command. Is it possible to create some kind of delay between these searches? Or is there another approach to solve this problem?

What I could think of, is to append a random append for internal data after the collect command, and remove this results directly afterwards. Just to create a longer duration of the search, so that the trigger for second search is set some seconds later.

Thanks in advance

0 Karma

0 Karma


So the append approach does not work, because the collect command seems to write the event to the index after the whole search finished.
Current workaround is that the first search writes the events to the index=test. This also sets a token to start a second search with random data, just to gain some seconds of time. This second search lives in a hidden panel and triggers another token to finally update the visualizing report for index=test.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...