Dashboards & Visualizations

Refresh a panel/form using a dropdown

Motivator

Hi, I'm trying to refresh a given panel or form using a dropdown. I have the dropdown configured and used the option value on the panel but it never refreshes. Does the option support a token based refresh?

0 Karma

Splunk Employee
Splunk Employee

1) The refresh.auto.interval parameter continues to work as documented in the current release of Splunk 6.4.3.

http://docs.splunk.com/Documentation/Splunk/6.4.3/Viz/PanelreferenceforSimplifiedXML

The refresh.auto.interval is documented to be set to a number. "Specifies, in seconds, the refresh interval. To disable panel refresh, specify 0 (or a negative integer)".

Use of token was not documented.

2) There is no fix for referesh.auto.interval in upcoming Splunk release in September/October 2016 (not sure of what version number it will get). The parameter refresh.auto.inverval is the legacy setting and is being deprecated now. It will behave exactly the same as it did in and before 6.4.3.

3) Further, in the new and upcoming release of Splunk the refresh.auto.interval is expected to be replaced by a new mechanism to specify the refresh interval and also refresh type delay or interval. It's recommended to move to the new notation.

4) The new notation supports tokens. Here's an example:

<form> 
<label>refresh token</label> 
<fieldset submitButton="false"></fieldset> 
<row> 
<panel> 
<input type="dropdown" token="refresh"> 
<label>Refresh</label> 
<choice value="5s">Every 5 seconds</choice> 
<choice value="30s">Every 30 seconds</choice> 
<choice value="0">Never</choice> 
</input> 
<single> 
<search> 
<query>index=_internal | stats count</query> 
<earliest>-15m</earliest> 
<latest>now</latest> 
<refresh>$refresh$</refresh> 
<refreshType>delay</refreshType> 
</search> 
</single> 
</panel> 
</row> 
</form> 

The token value has to be a valid relative time expression or number (in seconds) to work.

New Member

This does not work for me on 6.6.2. I keep setting it, trying different things in the tag (including constants, though I want it to work with a drop-down).

0 Karma

Path Finder

Does anyone know if this change has been made already? And what version has this new feature?

Thanks

0 Karma

Path Finder

Does anyone know if this change has been made already? And what version has this new feature?

Thanks

0 Karma

Motivator

Thanks Ravis! Looking forward to the new version/feature. It will be very helpful!!

0 Karma

Splunk Employee
Splunk Employee

I edited the XML to show up properly

0 Karma

Motivator

Thanks Ravis! Just to confirm, the xml you posted, that syntax DOES NOT work with the current released version of Splunk, correct?

0 Karma

Motivator

Sure! Sorry I should have done that from the beginning

<input type="dropdown" token="refreshrate" searchWhenChanged="true">
      <label>Select a Refresh Rate</label>
     <default>0</default>
      <choice value="60">1 min</choice>
      <choice value="180">3 min</choice>
      <choice value="300">5 min</choice>
      <choice value="600">10 min</choice>
      <choice value="900">15 min</choice>

    </input>




row>
    <panel>
      <title>Logins - for $field1.earliest$ to $field1.latest$ with a 1hr Trend</title>
      <single>
        <search>
          <query>host="*beta*" index=wls sourcetype=wls_managedserver |rex field=message_text "X-login:\s(?&lt;Login&gt;[^\s\:;]+)"|timechart span=1hr   count(Login)</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="refresh.auto.interval">"$refreshrate$"</option>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">all</option>
        <option name="underLabel">Click for Expanded View of Valid Logins</option>
        <option name="linkFields">underlabel, afterlabel</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0xd93f3c","0x65a637"]</option>
        <option name="rangeValues">[0]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
        <option name="refresh.link.visible">true</option>
        <drilldown>
          <set token="showtimechart">y</set>
        </drilldown>
        <option name="linkView">search</option>
      </single>
      <chart depends="$showtimechart$">
        <title>Expanded Valid Logins for $field1.earliest$ to $field1.latest$</title>
        <search>
          <query>host="*beta*" index=wls sourcetype=wls_managedserver |rex field=message_text "X-login:\s(?&lt;Login&gt;[^\s\:;]+)"|timechart usenull=f span=1h count(Login) as "Login Count" by Login|</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">zero</option>
        <option name="charting.chart.showDataLabels">minmax</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.axisTitleY.text">Count</option>
      </chart>
0 Karma

SplunkTrust
SplunkTrust

First, did you try removing the double quotes around "$refreshrate$"? The value should be integer.

Second, I haven't tried it on refresh.auto.intervalproperty, but I had tried on table's count option and it didn't work. The reason I figured was that the token values are always considered string (in search query something it's being type-casted implicitly, but I don't think that happens in the xml portion of it) and the value expected by Splunk was numeric/integer. So, it may not be possible.

0 Karma

Influencer

interesting. It worked on 6.2.5 at least. But it appears to no longer work with 6.4.1. (Having just made the jump from 6.2.5 to 6.4.1 and seeing this break.)

0 Karma

Motivator

I put in a Splunk support case. Appears there is a patch/fix/upgrade in October-ish that will include this feature (again).

0 Karma

Influencer

Can you share the case #?

0 Karma

Motivator

Case Number
388318

0 Karma

Motivator

I did try it without the quotes and it didn't work, so I figured to try it with the quotes... no joy

Well worst case if this doesn't work on a panel is there a way to get this to work on a form?

0 Karma

SplunkTrust
SplunkTrust

Could you post your dashboard xml?

0 Karma