Dashboards & Visualizations

How to remove the refreshed indicator at the top right of panel?

Path Finder

I have a dashboard which displays saved searches with historical data (past days) and its a little confusing to see that every time I click on a dashboard the Refresh indicator displays "1s ago", when really the data is from yesterday for example.

Has anyone played with this option within the advanced XML of the dashboard? Maybe its an obscure module. I played around with the refresh option of the <view> tag, but no go. Any input is appreciated.

1 Solution

SplunkTrust
SplunkTrust

There are two options. The more brute force way is to use custom CSS to make them go away, like so:

.splView-my_view_name_here .splLastRefreshed {
    display:none
}

And the easier way is to stop using the group="my panel header goes here" attributes in your XML. The last-refreshed indicator is an unfortunate side effect of those group headers.

Fortunately you can stop using those group attributes and then just display your own headers like so:

If you're using Sideview Utils you can do:

<module name="HTML" layoutPanel="panel_row1_col1">
  <param name="html"><![CDATA[
    <h2>This is my panel header</h2>
  ]]></param>
</module>

and incorporate the actual absolute timerange searched by the job with $results.timeRange.label$. and the label for the time range arguments sent with the search using $search.timeRange.label$. (The difference between the two is that basically one might say "yesterday" and the other will say "March 28th 2013". The results one is always displayed as an absolute timerange)

if you're using only core splunk modules you can do the same with StaticContentSample but you wont be able to use any $foo$ tokens.

<module name="StaticContentSample" layoutPanel="panel_row1_col1">
  <param name="text"><![CDATA[
    <h2>This is my panel header</h2>
  ]]></param>
</module>

View solution in original post

Explorer

.dashboard-row .dashboard-panel .refresh-time-indicator .time-freshness{
font-size: 0px;
color:#ffffff;}

0 Karma

Path Finder

I have tried the 'brute force' method suggested above with no success. Is this still valid in splunk 6 or was this for a previous version? If this was the solution for a previous version, is there a way to do this with v6? Thanks.

0 Karma

SplunkTrust
SplunkTrust

Yes in Splunk 6, with "Simple XML" dashboards, the implementation of the page underneath was completely changed so none of this CSS will work. If you're using Advanced XML in Splunk 6, with or without the improved modules from Sideview Utils, the old CSS trick will still work.

0 Karma

SplunkTrust
SplunkTrust

There are two options. The more brute force way is to use custom CSS to make them go away, like so:

.splView-my_view_name_here .splLastRefreshed {
    display:none
}

And the easier way is to stop using the group="my panel header goes here" attributes in your XML. The last-refreshed indicator is an unfortunate side effect of those group headers.

Fortunately you can stop using those group attributes and then just display your own headers like so:

If you're using Sideview Utils you can do:

<module name="HTML" layoutPanel="panel_row1_col1">
  <param name="html"><![CDATA[
    <h2>This is my panel header</h2>
  ]]></param>
</module>

and incorporate the actual absolute timerange searched by the job with $results.timeRange.label$. and the label for the time range arguments sent with the search using $search.timeRange.label$. (The difference between the two is that basically one might say "yesterday" and the other will say "March 28th 2013". The results one is always displayed as an absolute timerange)

if you're using only core splunk modules you can do the same with StaticContentSample but you wont be able to use any $foo$ tokens.

<module name="StaticContentSample" layoutPanel="panel_row1_col1">
  <param name="text"><![CDATA[
    <h2>This is my panel header</h2>
  ]]></param>
</module>

View solution in original post

SplunkTrust
SplunkTrust

Excellent. I'm glad.

0 Karma

Path Finder

Outstanding !! Your answer was very well explained and overall helpful. My problem was fixed in less than 2 minutes after reading your suggestions. Thanks a many. I only have the core Splunk modules so I just used the StaticContentSample module. That was it !! Awesome....

0 Karma