Re: How to get HTML panels to automatically refres...

swilsonGresham · ‎12-08-2015

Previously, on Splunk 6.2, I had a dashboard which contained a number of single value panels which simply displayed an icon. Depending on the messages in the logs, this icon would change as required (so a traffic light dashboard). This worked perfectly and each panel on the dashboard would refresh independently using the parameter

<option name="refresh.auto.interval">54</option>

After upgrading to 6.3 on a test system, the dashboards have broken and it turns out this is because of significant changes that have been made to single value panels in 6.3 https://answers.splunk.com/answers/318605/after-upgrade-to-splunk-63-dashboard-single-value.html provides a little more detail around that

As such, I have attempted to recreate the dashboards using the Custom Decorations example in this app: https://splunkbase.splunk.com/app/1603/

Basically, this makes each panel an html panel. This works perfectly in regards to displaying the icons correctly. The problem is I can't work out how I get those panels to independently refresh. I had thought I could add something similar to "refresh.auto.interval": "60" to the element, but this has no affect (Presumably because the element is an HtmlElement rather than a SingleElement).

Can anybody provide me with an example of how I can get an HtmlElement to refresh?

frobinson_splun · ‎12-08-2015

Hi @swilsonGresham,
I'm not sure of all of the details of your dashboard setup, but have you tried using the HTML meta tag to refresh an HTML panel? Here's some more details on a website that discusses this:
http://devzone.co.in/automatically-refresh-html-page-div-specific-time-interval/

Let me know if this does not work. We can continue discussing.

Hope this helps!

swilsonGresham · ‎12-09-2015

Thanks frobinson.

Unfortunately I have already attempted to use the meta tag (possibly incorrectly) but whilst it does refresh, it refreshes the entire page rather than just the panel.

To try and give you a feel for the dashboard we have created. It is actually a fairly simple traffic light dashboard. We are simply looking in the logs for certain messages and, depending on the message we see, the traffic light will display the appropriate colour. Depending on exactly what we are monitoring though the refresh rate of the panel matters (some need to be refreshed every minute, some hourly or longer).

In design the dashboard is simple. I have created a new dashboard (well actually we have a "form" tag) and then created all my searches for that form: As an example:

  <search>
    <query>search criteria | rangemap field=status low=0-0 severe=1-1 default=severe</query>
    <preview>
      <set token="range1">$result.range$</set>
    </preview>
  </search>

I have then created a panel which calls range1 so

  <row>
    <panel>
      <title>Status</title>
      <html>
        <h3>Started\Stopped</h3>
       <div class="custom-result-value $range1$">
       </div>
      </html>
    </panel> 
 </row>

To confirm the form is using the customer_decorations.css style sheet so

<form stylesheet="custom_decorations.css">

I obviously have multiple searches and panels.

If I add the meta tag then unfortunately, as I have said, the whole page will refresh. I have played around with putting different tags around the "meta" tag (so placing it in a "body" tag as an example).

I suspect I need to get more complex with this. but it seems a little frustrating for what (on the face of it) seems a rather simple concept. I am happy to convert the complete page to html (which you can easily do in Splunk) but currently I am still left with the same issue of how to get the panels (which will be an HtmlElement)l to refresh.

Any help/suggestions are much appreciated.

frobinson_splun · ‎12-09-2015

Hi @swilsonGresham,
Thanks for the additional details. I will take a look and see what I can suggest!

frobinson_splun · ‎12-09-2015

Hi again,
So after consulting with our engineering team, unfortunately there is no way to refresh the panel's HTML content at this time.

I realize that it might not suit your situation, but as an alternative you might consider working with a gauge visualization, which, with some customization, might offer some similarity in look/feel to your custom traffic light visualization. Here is some documentation about gauges:
http://docs.splunk.com/Documentation/Splunk/6.3.1/Viz/Visualizationreference#Gauges

Other visualization types are covered in this topic, so perhaps there will be another option to explore.

You can also check out examples in the Dashboards example app:
https://splunkbase.splunk.com/app/1603/

I hope this helps!

All the best,
@frobinson_splunk

swilsonGresham · ‎12-11-2015

Thanks frobinson,

I have had a look at the gauges and whilst I can use them it does feel a big backward step if I am honest. What has actually changed in the new single value panels?

it is a little frustrating as I have found that (if i dont switch to html panels) I can either show the icons on 6.3 but they are misaligned or I can align everything up but I don't see the icons, rather I just see the result of the rangemap.

I feel what I am attempting to do is within touching distance but I just can't achieve it.

frobinson_splun · ‎12-11-2015

Hi @swilsonGresham,
I'm sorry that you are frustrated. There have indeed been changes to single value that can cause existing visualizations to appear differently in 6.3. Please see this earlier post on Answers:
https://answers.splunk.com/answers/318605/after-upgrade-to-splunk-63-dashboard-single-value.html

In that thread, you might notice that positioning and alignment can be adjusted using custom decorations. There are two examples in the Dashboard Examples App that might help with this: Image Overlay and Custom Decorations.

The Image Overlay example also makes use of search event handlers, which are documented here:
http://docs.splunk.com/Documentation/Splunk/6.3.1/Viz/EventHandlerReference#Search_event_handlers

Finally, this is somewhat experimental, but if you do end up using a gauge or single value viz, you might try reworking your query to not use "rangemap" and make all range configurations in the Format editor. I'm not sure if this will help, but using "rangemap" in new single value viz is not recommended as the "rangemap" settings do not work well with (and are in fact overridden by) Format menu setttings.

I hope some of this is helpful to you! Let me know if you have other questions.

Best,
@frobinson_splunk

How to get HTML panels to automatically refresh in Splunk 6.3?

Routing logs with Splunk OTel Collector for Kubernetes

Welcome to the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM