Dashboards & Visualizations

How to create a dashboard that only updates data on a specific day and time?

dbcase
Motivator

Hi,

I have a dashboard that reflects subscriber counts. It works just fine except for one little detail. This report is sent out on a weekly basis every Sunday at 2:00 am Central time. The dashboard currently updates every five minutes with new data. Is there a way I can create a dashboard that keeps the data static from the Sunday at 2:00 am and only updates the data the next Sunday at 2:00 am?

0 Karma
1 Solution

vasanthmss
Motivator

try to provide the time range - earliest and latest.

edit your dashboard - edit search - enter your search
edit your dashboard - edit search - Time Range Scope - Explicit Selection - Advanced -> -1w@w to @w+2h@h

meaning you can define time range of your search & reporting based on the earliest and latest.

View solution in original post

vasanthmss
Motivator

try to provide the time range - earliest and latest.

edit your dashboard - edit search - enter your search
edit your dashboard - edit search - Time Range Scope - Explicit Selection - Advanced -> -1w@w to @w+2h@h

meaning you can define time range of your search & reporting based on the earliest and latest.

View solution in original post

dbcase
Motivator

I think we are close on this one. A follow on question is even if I put earliest=@w+2h@h doesn't the dashboard continue to update during the week?

Meaning if a subscriber count is 3000 at sunday at 2am that count needs to stay the same until the next sunday at 2 am when it will then increase or decrease by the week's numbers

0 Karma

dbcase
Motivator

Would something like this work?

earliest=@w+2h@h latest=@w+2h@h+10m 
0 Karma

bmacias84
Champion

have your dashboard search(es) reference the saved search rather than an inline.

0 Karma

dbcase
Motivator

Hi Bmacias84,

Sorry I'm not quite getting the concept.

The current search looks like this. Which works but I need to be able to recreate the report from Sunday at 2:00am and that doesn't work with this search.

earliest=-24h index=mso_statistics sourcetype=ic_connectivity_5min-too_small  stat_name=subscribers |eval mso = upper(substr(mso,1,1)).lower(substr(mso,2)) |chart max(stat_val) as "Subscribers" by mso|addcoltotals labelfield=mso label=Total|eval Subscribers=tostring(Subscribers,"commas")|rename mso as "MSO - Click for Expanded View"
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!