Dashboards & Visualizations

How to display real-time data in a dashboard?

Hindoo
Path Finder

Hello,

I managed to display a dashboard for data in the last 24 hours or last week, but when I want to display real-time, it shows me "No results in current time range."
In short, I want to display a dashboard in real-time.
I need your help please !!!!!

Tags (2)

gyslainlatsa
Motivator

hi hindoo,
this is a code for one example of the dashboard real time

  <dashboard>
      <label>Realtime Search</label>
      <description>Table, Chart and Event panels powered by inline and report realtime searches.</description>
      <row>
        <table>
          <title>Inline Search Table</title>
          <search>
            <query>index=_internal | head 1000 | top limit=100 sourcetype | eval percent = round(percent,2)</query>
            <earliest>rt-30s</earliest>
            <latest>rt</latest>
          </search>
        </table>
        <chart>
          <title>Inline Search Chart</title>
          <search>
            <query>index=_internal | head 1000 | timechart count</query>
            <earliest>rt-30s</earliest>
            <latest>rt</latest>
          </search>
          <option name="charting.chart">area</option>
        </chart>
      </row>
  </dashboard>

use this time range rt-30s and rt in your dashboard and let me know.
for the last 24hrs, use this time range -24h@hand now

gyslainlatsa
Motivator

hi hindoo,

you said one source with source = "192.168.1.203",
it is likely that there is no result for this uique source in real time. try to select all sources with source = * and check if there will not always results. and if it works, you could create a dropdown where the user can select a particular source.

if you want to get all the results you have to write |top limit = 0, to generalize, you might have a code like this:

<form>
  <label>---------------------------------------</label>
  <description>---------------------</description>
  <fieldset autoRun="true" submitButton="false">
    <input type="dropdown" token="source" searchWhenChanged="true">
      <label>Select a source:</label>
      <default>*</default>
      <choice value="*">All</choice>
      <populatingSearch fieldForValue="source" fieldForLabel="source" >
        <![CDATA[sourcetype=syslog | stats count by source]]>
      </populatingSearch>
    </input>
  </fieldset>
  <row>

      <table>          
       <title>Inline Search Table</title> 
       <search>           
         <query> sourcetype= syslog source= $source$ | top limit=10</query>     
         <earliest>rt-30s</earliest>
         <latest>rt</latest>           
       </search>        
     </table> 

  </row>
</form>

please forgive my english.

0 Karma

Hindoo
Path Finder

thanks,
i try with your example:

Realtime Search

Table by inline and report realtime searches.

<table>          
  <title>Inline Search Table</title> 
  <search>           
    <query> sourcetype= syslog source="192.168.1.203" | top limit=10</query>     
    <earliest>rt-30s</earliest>
    <latest>rt</latest>           
  </search>        
</table>      

but , no result ...

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...