Dashboards & Visualizations

Real time dashboard

timmalos
Communicator

Hi
I'm trying to make my dashboard Real-time refreshed but still got issues.
A simply xml like this dosnt make my singleValue refreshed in real time.
Do i do something wrong?

 <view isVisible="true"  template="dashboard.html">
<label>Monitoring</label>
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="DashboardTitleBar" layoutPanel="viewHeader"/>
<module name="Message" layoutPanel="navigationHeader">
    <param name="filter">*</param>
    <param name="maxSize">1</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="level">warn</param>
</module>
<!-- HiddenSearch R2C1 -->
<module name="HiddenSavedSearch" layoutPanel="panel_row2_col1" group="Last client backed up" autoRun="True">
    <param name="savedSearch">CountJobs</param>
    <module name="EnablePreview">
        <param name="enable">True</param>
        <param name="display">False</param>
        <module name="HiddenFieldPicker">

            <module name="SingleValue"></module>
        </module>
    </module>       
</module>

My Countjob (Display the last event indexed)saved search is :
sourcetype="CSVCOMPLETE" | head 1|convert timeformat="%b %d (%a), %H:%M:%S" ctime(_time) as Date |eval output = toString(Client) + " the " + toString(Date)|table output

Start time : rt-1h@m
Finish time : rt

Thx for your help !

0 Karma
1 Solution

timmalos
Communicator

Seems the problem was in the savedsearch. Just be replacing my search by this made it work:

[NBsummary_CountJobs]
displayview = flashtimeline
search = index="netbackup" sourcetype="Netbackup" host=$host$ | stats latest(_time) |convert timeformat="%b %d (%a),   %H:%M:%S" ctime(latest(_time))  as Date | table Date

[NBsummary_CountJobsFirst]
displayview = flashtimeline
search =  index="netbackup" sourcetype="Netbackup" host=$host$ | stats earliest(_time) |convert timeformat="%b %d (%a),   %H:%M:%S" ctime(earliest(_time))  as Date | table Date

Cant manage thought to understand the problem with head and tail that returned weird results.

View solution in original post

0 Karma

timmalos
Communicator

Seems the problem was in the savedsearch. Just be replacing my search by this made it work:

[NBsummary_CountJobs]
displayview = flashtimeline
search = index="netbackup" sourcetype="Netbackup" host=$host$ | stats latest(_time) |convert timeformat="%b %d (%a),   %H:%M:%S" ctime(latest(_time))  as Date | table Date

[NBsummary_CountJobsFirst]
displayview = flashtimeline
search =  index="netbackup" sourcetype="Netbackup" host=$host$ | stats earliest(_time) |convert timeformat="%b %d (%a),   %H:%M:%S" ctime(earliest(_time))  as Date | table Date

Cant manage thought to understand the problem with head and tail that returned weird results.

0 Karma
Get Updates on the Splunk Community!

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...