Hi, I'm trying to refresh a given panel or form using a dropdown. I have the dropdown configured and used the option value on the panel but it never refreshes. Does the option support a token based refresh?
1) The refresh.auto.interval parameter continues to work as documented in the current release of Splunk 6.4.3.
http://docs.splunk.com/Documentation/Splunk/6.4.3/Viz/PanelreferenceforSimplifiedXML
The refresh.auto.interval is documented to be set to a number. "Specifies, in seconds, the refresh interval. To disable panel refresh, specify 0 (or a negative integer)".
Use of token was not documented.
2) There is no fix for referesh.auto.interval in upcoming Splunk release in September/October 2016 (not sure of what version number it will get). The parameter refresh.auto.inverval is the legacy setting and is being deprecated now. It will behave exactly the same as it did in and before 6.4.3.
3) Further, in the new and upcoming release of Splunk the refresh.auto.interval is expected to be replaced by a new mechanism to specify the refresh interval and also refresh type delay or interval. It's recommended to move to the new notation.
4) The new notation supports tokens. Here's an example:
<form>
<label>refresh token</label>
<fieldset submitButton="false"></fieldset>
<row>
<panel>
<input type="dropdown" token="refresh">
<label>Refresh</label>
<choice value="5s">Every 5 seconds</choice>
<choice value="30s">Every 30 seconds</choice>
<choice value="0">Never</choice>
</input>
<single>
<search>
<query>index=_internal | stats count</query>
<earliest>-15m</earliest>
<latest>now</latest>
<refresh>$refresh$</refresh>
<refreshType>delay</refreshType>
</search>
</single>
</panel>
</row>
</form>
The token value has to be a valid relative time expression or number (in seconds) to work.
This does not work for me on 6.6.2. I keep setting it, trying different things in the tag (including constants, though I want it to work with a drop-down).
Does anyone know if this change has been made already? And what version has this new feature?
Thanks
Does anyone know if this change has been made already? And what version has this new feature?
Thanks
Thanks Ravis! Looking forward to the new version/feature. It will be very helpful!!
I edited the XML to show up properly
Thanks Ravis! Just to confirm, the xml you posted, that syntax DOES NOT work with the current released version of Splunk, correct?
Sure! Sorry I should have done that from the beginning
<input type="dropdown" token="refreshrate" searchWhenChanged="true">
<label>Select a Refresh Rate</label>
<default>0</default>
<choice value="60">1 min</choice>
<choice value="180">3 min</choice>
<choice value="300">5 min</choice>
<choice value="600">10 min</choice>
<choice value="900">15 min</choice>
</input>
row>
<panel>
<title>Logins - for $field1.earliest$ to $field1.latest$ with a 1hr Trend</title>
<single>
<search>
<query>host="*beta*" index=wls sourcetype=wls_managedserver |rex field=message_text "X-login:\s(?<Login>[^\s\:;]+)"|timechart span=1hr count(Login)</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="refresh.auto.interval">"$refreshrate$"</option>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="drilldown">all</option>
<option name="underLabel">Click for Expanded View of Valid Logins</option>
<option name="linkFields">underlabel, afterlabel</option>
<option name="numberPrecision">0</option>
<option name="rangeColors">["0xd93f3c","0x65a637"]</option>
<option name="rangeValues">[0]</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="unitPosition">after</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
<option name="refresh.link.visible">true</option>
<drilldown>
<set token="showtimechart">y</set>
</drilldown>
<option name="linkView">search</option>
</single>
<chart depends="$showtimechart$">
<title>Expanded Valid Logins for $field1.earliest$ to $field1.latest$</title>
<search>
<query>host="*beta*" index=wls sourcetype=wls_managedserver |rex field=message_text "X-login:\s(?<Login>[^\s\:;]+)"|timechart usenull=f span=1h count(Login) as "Login Count" by Login|</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="charting.chart">line</option>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">zero</option>
<option name="charting.chart.showDataLabels">minmax</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="charting.axisTitleY.text">Count</option>
</chart>
First, did you try removing the double quotes around "$refreshrate$"
? The value should be integer.
Second, I haven't tried it on refresh.auto.interval
property, but I had tried on table's count option and it didn't work. The reason I figured was that the token values are always considered string (in search query something it's being type-casted implicitly, but I don't think that happens in the xml portion of it) and the value expected by Splunk was numeric/integer. So, it may not be possible.
interesting. It worked on 6.2.5 at least. But it appears to no longer work with 6.4.1. (Having just made the jump from 6.2.5 to 6.4.1 and seeing this break.)
I put in a Splunk support case. Appears there is a patch/fix/upgrade in October-ish that will include this feature (again).
Can you share the case #?
Case Number
388318
I did try it without the quotes and it didn't work, so I figured to try it with the quotes... no joy
Well worst case if this doesn't work on a panel is there a way to get this to work on a form?
Could you post your dashboard xml?