Dashboards & Visualizations

Is it possible to add the runtime to each dashboard panel?

Motivator

Hi,

is there an option to add the runtime of the search to the panel actions?

Thanks in advance

0 Karma

Super Champion

i don't believe so. it looks like these might be the only options:

http://docs.splunk.com/Documentation/Splunk/6.6.1/Viz/PanelreferenceforSimplifiedXML#Shared_options
export/inspect/open/refresh.

could be a good enhancement.

you can, however, create a token with $job.runDuration$ and that will give you the number of seconds that the search took to complete, and possibly display that in the panel description?
http://docs.splunk.com/Documentation/Splunk/6.6.1/Viz/tokens#Search_event_elements_and_job_propertie...

Motivator

I'm not sure how this is supposed to look like. I would need a form dashboard and would not be able to use saved searches, right?

0 Karma

Super Champion

if you used saved searches, you can use the _audit index to grab the run duration and create the token from that. the search is something like index=_audit action=search savedsearch_name=* info=completed|stats sum(total_run_time) as runDuration by savedsearch_name _time

oh but sorry, yes, this would need to be inside of a dashboard, it wouldn't be visible in a report page.

Motivator

that would mean to much effort 🙂 but thanks anyway!

0 Karma