Hi
I'm trying to make my dashboard Real-time refreshed but still got issues.
A simply xml like this dosnt make my singleValue refreshed in real time.
Do i do something wrong?
<view isVisible="true" template="dashboard.html">
<label>Monitoring</label>
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="DashboardTitleBar" layoutPanel="viewHeader"/>
<module name="Message" layoutPanel="navigationHeader">
<param name="filter">*</param>
<param name="maxSize">1</param>
<param name="clearOnJobDispatch">True</param>
<param name="level">warn</param>
</module>
<!-- HiddenSearch R2C1 -->
<module name="HiddenSavedSearch" layoutPanel="panel_row2_col1" group="Last client backed up" autoRun="True">
<param name="savedSearch">CountJobs</param>
<module name="EnablePreview">
<param name="enable">True</param>
<param name="display">False</param>
<module name="HiddenFieldPicker">
<module name="SingleValue"></module>
</module>
</module>
</module>
My Countjob (Display the last event indexed)saved search is :
sourcetype="CSVCOMPLETE" | head 1|convert timeformat="%b %d (%a), %H:%M:%S" ctime(_time) as Date |eval output = toString(Client) + " the " + toString(Date)|table output
Start time : rt-1h@m
Finish time : rt
Thx for your help !
Seems the problem was in the savedsearch. Just be replacing my search by this made it work:
[NBsummary_CountJobs]
displayview = flashtimeline
search = index="netbackup" sourcetype="Netbackup" host=$host$ | stats latest(_time) |convert timeformat="%b %d (%a), %H:%M:%S" ctime(latest(_time)) as Date | table Date
[NBsummary_CountJobsFirst]
displayview = flashtimeline
search = index="netbackup" sourcetype="Netbackup" host=$host$ | stats earliest(_time) |convert timeformat="%b %d (%a), %H:%M:%S" ctime(earliest(_time)) as Date | table Date
Cant manage thought to understand the problem with head and tail that returned weird results.
Seems the problem was in the savedsearch. Just be replacing my search by this made it work:
[NBsummary_CountJobs]
displayview = flashtimeline
search = index="netbackup" sourcetype="Netbackup" host=$host$ | stats latest(_time) |convert timeformat="%b %d (%a), %H:%M:%S" ctime(latest(_time)) as Date | table Date
[NBsummary_CountJobsFirst]
displayview = flashtimeline
search = index="netbackup" sourcetype="Netbackup" host=$host$ | stats earliest(_time) |convert timeformat="%b %d (%a), %H:%M:%S" ctime(earliest(_time)) as Date | table Date
Cant manage thought to understand the problem with head and tail that returned weird results.