Dashboards & Visualizations

How to create a dashboard that only updates data on a specific day and time?

dbcase
Motivator

Hi,

I have a dashboard that reflects subscriber counts. It works just fine except for one little detail. This report is sent out on a weekly basis every Sunday at 2:00 am Central time. The dashboard currently updates every five minutes with new data. Is there a way I can create a dashboard that keeps the data static from the Sunday at 2:00 am and only updates the data the next Sunday at 2:00 am?

0 Karma
1 Solution

vasanthmss
Motivator

try to provide the time range - earliest and latest.

edit your dashboard - edit search - enter your search
edit your dashboard - edit search - Time Range Scope - Explicit Selection - Advanced -> -1w@w to @w+2h@h

meaning you can define time range of your search & reporting based on the earliest and latest.

V

View solution in original post

vasanthmss
Motivator

try to provide the time range - earliest and latest.

edit your dashboard - edit search - enter your search
edit your dashboard - edit search - Time Range Scope - Explicit Selection - Advanced -> -1w@w to @w+2h@h

meaning you can define time range of your search & reporting based on the earliest and latest.

V

dbcase
Motivator

I think we are close on this one. A follow on question is even if I put earliest=@w+2h@h doesn't the dashboard continue to update during the week?

Meaning if a subscriber count is 3000 at sunday at 2am that count needs to stay the same until the next sunday at 2 am when it will then increase or decrease by the week's numbers

0 Karma

dbcase
Motivator

Would something like this work?

earliest=@w+2h@h latest=@w+2h@h+10m 
0 Karma

bmacias84
Champion

have your dashboard search(es) reference the saved search rather than an inline.

0 Karma

dbcase
Motivator

Hi Bmacias84,

Sorry I'm not quite getting the concept.

The current search looks like this. Which works but I need to be able to recreate the report from Sunday at 2:00am and that doesn't work with this search.

earliest=-24h index=mso_statistics sourcetype=ic_connectivity_5min-too_small  stat_name=subscribers |eval mso = upper(substr(mso,1,1)).lower(substr(mso,2)) |chart max(stat_val) as "Subscribers" by mso|addcoltotals labelfield=mso label=Total|eval Subscribers=tostring(Subscribers,"commas")|rename mso as "MSO - Click for Expanded View"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...