Splunk Dashboard with auto refresh.

[nilaksh92]

Hi Everyone,

I am facing following issue.

I have a dashboard which is getting refreshed after every 30 seconds. In the same dashboard I have created drill down functionality.

Issue:- Whenever I am doing drill down. Suppose Now I am at second panel of drill down. But whenever dashboard refreshes the panel automatically does drill up.

But I don't want to drill up on dashboard refresh,

Please help me out to resolve this issue.

Thanks in advance
Nikks

[sravankaripe]

Try this

If you can to refresh panel use this tag
<option name="refresh.auto.interval">30</option>

if you want to refresh whole dashboard
<form refresh="30">

[kamlesh_vaghela]

Hi Nilaksh,

Can you please let me know, in your dashboard how many panels actually needs to be refreshed?? I think initial panels only needs to be refreshed.

If you are showing other panels which are not required to be refresh then refresh only those particular panels.

Can you please try below search pattern in initial panels of your dashboard??

<search>
          <query>  YOUR SEARCH </query>
          <earliest>-1h@m</earliest>
          <latest>now</latest>
          **<refresh>30s</refresh>
          <refreshType>delay</refreshType>**
        </search>

[nilaksh92]

Hi Kamlesh,

Data of all panels is getting refreshed after each 30 seconds.

For that I have made, 30s in all base searches.

Whenever I drill down to second panel if time crosses 30 seconds, the panel again comes back to panel 1.'

I want the panel should not come back to first panel even refresh time is over.

Thanks in advance.

[kamlesh_vaghela]

Hi Nilaksh,

I'm not sure how you are using base searches with auto refresh search.

But yes, I have tried with single base search and 2 level drill downs within 3 panels and It's working as your need. So please check below XML. Check token which used in panel's depends. I hope it will be useful to you.

<dashboard>
  <label>TestDM Dashboard</label>
  <search id="baseSearch">
    <query>index=_internal | table _time sourcetype source</query>
    <earliest>-1h@h</earliest>
    <latest>now</latest>
    <refresh>15s</refresh>
    <refreshType>delay</refreshType>
  </search>
  <row>
    <panel>
      <chart>
        <search base="baseSearch">
          <query>timechart count by sourcetype</query>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">all</option>
        <drilldown>
          <set token="clicked_value">$click.name2$</set>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel depends="$clicked_value$">
      <table>
        <title>$clicked_value$</title>
        <search base="baseSearch">
          <query>search sourcetype="$clicked_value$" | table _time sourcetype source</query>
        </search>
        <option name="drilldown">row</option>
        <drilldown>
          <set token="clicked_value2">$row.sourcetype$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$clicked_value2$">
      <title>$clicked_value2$</title>
      <chart>
        <search base="baseSearch">
          <query>search sourcetype="$clicked_value2$" |stats count by source</query>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</dashboard>

[nilaksh92]

Hi Kamlesh,

Can you drill down to second or third panel for 15 seconds and please see whether it is going to first panel automatically or not?

I tried the same approach, but first panel use to come after the refresh irrespective of whether we are on second or third panel.

Thanks in advance.

[kamlesh_vaghela]

Hi Nilaksh,

Yes, drilldown working fine for 2nd and 3rd panel.

Can I see your xml ? You can hide your query by replacing your search query with <<MY SEARCH>>.

Thanks
Kamlesh

[nilaksh92]

Hi Kamlesh,

Here is xml of my base search.

<search id="nikks"> <query> ** <query>
<earliest> @d </earliest>
 <sampleRatio>1</sampleRatio>
<refresh>30s</refresh>
<refreshType>delay</refreshType>
 </search>

[kamlesh_vaghela]

Hi Nilaksh,
:)
I'm unable to see xml. Use "Code Sample" tool from toolbar to make it visible. 🙂

Can you please provide xml of basesearch as well as 2nd or 3rd panels?

Thanks
Kamlesh

[nilaksh92]

Hi please find my second panel's xml

<panel depends="$abc$" rejects="$xyz$">
<table>
<search base="nikks">
<query> ** <query>
</search>
<option name="drilldown">cell</option>
<drilldown target="_blank">
<set token="xyz"></set>
<unset token="abc"></unset>
</drildown>
......

[kamlesh_vaghela]

Hi Nilaksh,

It's little delayed.

I have answered on a Splunk question where panel hide show is mainly concerned.

So can you please see my answer on below link??

https://answers.splunk.com/answers/527558/drill-down-and-drill-up-on-3-panels.html

Thanks
Kamlesh

[nilaksh92]

Hi Kamlesh,

I have implemented in same way. But still facing same issue.

It is coming back to panel1 whenever refresh happens.

I am not able to find out what is the issue.

Are token values getting refreshed on auto refresh? Is that the case?

[kamlesh_vaghela]

Hi Nilaksh,
Can you please give me your full xml..??
Remove all your search...
I need to check see tokens only..

Thanks
Kamlesh

[somesoni2]

can you post your dashboard xml?

[nilaksh92]

Hi

It is similar to what Kamlesh has posted in below comment.