Dashboards & Visualizations

Refresh a panel/form using a dropdown

dbcase
Motivator

Hi, I'm trying to refresh a given panel or form using a dropdown. I have the dropdown configured and used the option value on the panel but it never refreshes. Does the option support a token based refresh?

0 Karma

ravis_splunk
Splunk Employee
Splunk Employee

1) The refresh.auto.interval parameter continues to work as documented in the current release of Splunk 6.4.3.

http://docs.splunk.com/Documentation/Splunk/6.4.3/Viz/PanelreferenceforSimplifiedXML

The refresh.auto.interval is documented to be set to a number. "Specifies, in seconds, the refresh interval. To disable panel refresh, specify 0 (or a negative integer)".

Use of token was not documented.

2) There is no fix for referesh.auto.interval in upcoming Splunk release in September/October 2016 (not sure of what version number it will get). The parameter refresh.auto.inverval is the legacy setting and is being deprecated now. It will behave exactly the same as it did in and before 6.4.3.

3) Further, in the new and upcoming release of Splunk the refresh.auto.interval is expected to be replaced by a new mechanism to specify the refresh interval and also refresh type delay or interval. It's recommended to move to the new notation.

4) The new notation supports tokens. Here's an example:

<form> 
<label>refresh token</label> 
<fieldset submitButton="false"></fieldset> 
<row> 
<panel> 
<input type="dropdown" token="refresh"> 
<label>Refresh</label> 
<choice value="5s">Every 5 seconds</choice> 
<choice value="30s">Every 30 seconds</choice> 
<choice value="0">Never</choice> 
</input> 
<single> 
<search> 
<query>index=_internal | stats count</query> 
<earliest>-15m</earliest> 
<latest>now</latest> 
<refresh>$refresh$</refresh> 
<refreshType>delay</refreshType> 
</search> 
</single> 
</panel> 
</row> 
</form> 

The token value has to be a valid relative time expression or number (in seconds) to work.

madkins23
New Member

This does not work for me on 6.6.2. I keep setting it, trying different things in the tag (including constants, though I want it to work with a drop-down).

0 Karma

sidekix24
Path Finder

Does anyone know if this change has been made already? And what version has this new feature?

Thanks

0 Karma

sidekix24
Path Finder

Does anyone know if this change has been made already? And what version has this new feature?

Thanks

0 Karma

dbcase
Motivator

Thanks Ravis! Looking forward to the new version/feature. It will be very helpful!!

0 Karma

ravis_splunk
Splunk Employee
Splunk Employee

I edited the XML to show up properly

0 Karma

dbcase
Motivator

Thanks Ravis! Just to confirm, the xml you posted, that syntax DOES NOT work with the current released version of Splunk, correct?

0 Karma

dbcase
Motivator

Sure! Sorry I should have done that from the beginning

<input type="dropdown" token="refreshrate" searchWhenChanged="true">
      <label>Select a Refresh Rate</label>
     <default>0</default>
      <choice value="60">1 min</choice>
      <choice value="180">3 min</choice>
      <choice value="300">5 min</choice>
      <choice value="600">10 min</choice>
      <choice value="900">15 min</choice>

    </input>




row>
    <panel>
      <title>Logins - for $field1.earliest$ to $field1.latest$ with a 1hr Trend</title>
      <single>
        <search>
          <query>host="*beta*" index=wls sourcetype=wls_managedserver |rex field=message_text "X-login:\s(?&lt;Login&gt;[^\s\:;]+)"|timechart span=1hr   count(Login)</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="refresh.auto.interval">"$refreshrate$"</option>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">all</option>
        <option name="underLabel">Click for Expanded View of Valid Logins</option>
        <option name="linkFields">underlabel, afterlabel</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0xd93f3c","0x65a637"]</option>
        <option name="rangeValues">[0]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
        <option name="refresh.link.visible">true</option>
        <drilldown>
          <set token="showtimechart">y</set>
        </drilldown>
        <option name="linkView">search</option>
      </single>
      <chart depends="$showtimechart$">
        <title>Expanded Valid Logins for $field1.earliest$ to $field1.latest$</title>
        <search>
          <query>host="*beta*" index=wls sourcetype=wls_managedserver |rex field=message_text "X-login:\s(?&lt;Login&gt;[^\s\:;]+)"|timechart usenull=f span=1h count(Login) as "Login Count" by Login|</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">zero</option>
        <option name="charting.chart.showDataLabels">minmax</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.axisTitleY.text">Count</option>
      </chart>
0 Karma

somesoni2
Revered Legend

First, did you try removing the double quotes around "$refreshrate$"? The value should be integer.

Second, I haven't tried it on refresh.auto.intervalproperty, but I had tried on table's count option and it didn't work. The reason I figured was that the token values are always considered string (in search query something it's being type-casted implicitly, but I don't think that happens in the xml portion of it) and the value expected by Splunk was numeric/integer. So, it may not be possible.

0 Karma

twinspop
Influencer

interesting. It worked on 6.2.5 at least. But it appears to no longer work with 6.4.1. (Having just made the jump from 6.2.5 to 6.4.1 and seeing this break.)

0 Karma

dbcase
Motivator

I put in a Splunk support case. Appears there is a patch/fix/upgrade in October-ish that will include this feature (again).

0 Karma

twinspop
Influencer

Can you share the case #?

0 Karma

dbcase
Motivator

Case Number
388318

0 Karma

dbcase
Motivator

I did try it without the quotes and it didn't work, so I figured to try it with the quotes... no joy

Well worst case if this doesn't work on a panel is there a way to get this to work on a form?

0 Karma

somesoni2
Revered Legend

Could you post your dashboard xml?

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...