Dashboards & Visualizations

How start a dashboard search based on a token and a time delay of n seconds



when I run a dashboard search, I'm writing an event to an index=test with the collect command. When this search is finished, it sets a token which is used to start a second search. This second is visualizing events from the index=test and should show the latest collected event when it runs.
Basically it works, but sometimes the seconds search does not recognize the latest event from index=test. I assume the second search starts to close after the collect command. Is it possible to create some kind of delay between these searches? Or is there another approach to solve this problem?

What I could think of, is to append a random append for internal data after the collect command, and remove this results directly afterwards. Just to create a longer duration of the search, so that the trigger for second search is set some seconds later.

Thanks in advance

0 Karma

0 Karma


So the append approach does not work, because the collect command seems to write the event to the index after the whole search finished.
Current workaround is that the first search writes the events to the index=test. This also sets a token to start a second search with random data, just to gain some seconds of time. This second search lives in a hidden panel and triggers another token to finally update the visualizing report for index=test.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...