Dashboards & Visualizations

How start a dashboard search based on a token and a time delay of n seconds



when I run a dashboard search, I'm writing an event to an index=test with the collect command. When this search is finished, it sets a token which is used to start a second search. This second is visualizing events from the index=test and should show the latest collected event when it runs.
Basically it works, but sometimes the seconds search does not recognize the latest event from index=test. I assume the second search starts to close after the collect command. Is it possible to create some kind of delay between these searches? Or is there another approach to solve this problem?

What I could think of, is to append a random append for internal data after the collect command, and remove this results directly afterwards. Just to create a longer duration of the search, so that the trigger for second search is set some seconds later.

Thanks in advance

0 Karma

0 Karma


So the append approach does not work, because the collect command seems to write the event to the index after the whole search finished.
Current workaround is that the first search writes the events to the index=test. This also sets a token to start a second search with random data, just to gain some seconds of time. This second search lives in a hidden panel and triggers another token to finally update the visualizing report for index=test.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...