Dashboards & Visualizations

How to remove the refreshed indicator at the top right of panel?

ten_yard_fight
Path Finder

I have a dashboard which displays saved searches with historical data (past days) and its a little confusing to see that every time I click on a dashboard the Refresh indicator displays "1s ago", when really the data is from yesterday for example.

Has anyone played with this option within the advanced XML of the dashboard? Maybe its an obscure module. I played around with the refresh option of the <view> tag, but no go. Any input is appreciated.

1 Solution

sideview
SplunkTrust
SplunkTrust

There are two options. The more brute force way is to use custom CSS to make them go away, like so:

.splView-my_view_name_here .splLastRefreshed {
    display:none
}

And the easier way is to stop using the group="my panel header goes here" attributes in your XML. The last-refreshed indicator is an unfortunate side effect of those group headers.

Fortunately you can stop using those group attributes and then just display your own headers like so:

If you're using Sideview Utils you can do:

<module name="HTML" layoutPanel="panel_row1_col1">
  <param name="html"><![CDATA[
    <h2>This is my panel header</h2>
  ]]></param>
</module>

and incorporate the actual absolute timerange searched by the job with $results.timeRange.label$. and the label for the time range arguments sent with the search using $search.timeRange.label$. (The difference between the two is that basically one might say "yesterday" and the other will say "March 28th 2013". The results one is always displayed as an absolute timerange)

if you're using only core splunk modules you can do the same with StaticContentSample but you wont be able to use any $foo$ tokens.

<module name="StaticContentSample" layoutPanel="panel_row1_col1">
  <param name="text"><![CDATA[
    <h2>This is my panel header</h2>
  ]]></param>
</module>

View solution in original post

nidhigoyal
Explorer

.dashboard-row .dashboard-panel .refresh-time-indicator .time-freshness{
font-size: 0px;
color:#ffffff;}

0 Karma

hogan24
Path Finder

I have tried the 'brute force' method suggested above with no success. Is this still valid in splunk 6 or was this for a previous version? If this was the solution for a previous version, is there a way to do this with v6? Thanks.

0 Karma

sideview
SplunkTrust
SplunkTrust

Yes in Splunk 6, with "Simple XML" dashboards, the implementation of the page underneath was completely changed so none of this CSS will work. If you're using Advanced XML in Splunk 6, with or without the improved modules from Sideview Utils, the old CSS trick will still work.

0 Karma

sideview
SplunkTrust
SplunkTrust

There are two options. The more brute force way is to use custom CSS to make them go away, like so:

.splView-my_view_name_here .splLastRefreshed {
    display:none
}

And the easier way is to stop using the group="my panel header goes here" attributes in your XML. The last-refreshed indicator is an unfortunate side effect of those group headers.

Fortunately you can stop using those group attributes and then just display your own headers like so:

If you're using Sideview Utils you can do:

<module name="HTML" layoutPanel="panel_row1_col1">
  <param name="html"><![CDATA[
    <h2>This is my panel header</h2>
  ]]></param>
</module>

and incorporate the actual absolute timerange searched by the job with $results.timeRange.label$. and the label for the time range arguments sent with the search using $search.timeRange.label$. (The difference between the two is that basically one might say "yesterday" and the other will say "March 28th 2013". The results one is always displayed as an absolute timerange)

if you're using only core splunk modules you can do the same with StaticContentSample but you wont be able to use any $foo$ tokens.

<module name="StaticContentSample" layoutPanel="panel_row1_col1">
  <param name="text"><![CDATA[
    <h2>This is my panel header</h2>
  ]]></param>
</module>

sideview
SplunkTrust
SplunkTrust

Excellent. I'm glad.

0 Karma

ten_yard_fight
Path Finder

Outstanding !! Your answer was very well explained and overall helpful. My problem was fixed in less than 2 minutes after reading your suggestions. Thanks a many. I only have the core Splunk modules so I just used the StaticContentSample module. That was it !! Awesome....

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...