Dashboards & Visualizations

How to hide dashboard panel when user's search times out?

kmaron
Motivator

We are dealing with an issue where some of our users have a very short timeout in Splunk. We are working with Splunk to come up with better timeouts but in the meantime we need a way to stop dashboard panels form loading when a user times out to prevent them seeing partial results. 

I have tried the normal tokens that are used to hide a panel until a search is done but these "stopped" searches report as done (they just have partial results).   I have seen old solutions that used "finalized" but that has been deprecated.  ('ve tried cancelled, fail and error as well, no luck)

Does anyone have any idea how else I can stop these panels from loading when a search is "stopped" because of a timeout?

 

Labels (1)
Tags (2)
0 Karma

kmaron
Motivator

I figured it out.  I was able to use the job.isFinalized token along with "done"

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...