Dashboards & Visualizations
Highlighted

Splunk panel refresh in background or don't clear the panel before refreshing?

Explorer

My splunk dashboard has ~60 panels based on a few (~5) base searches and a post processing for each panel.

Whenever the base search is refreshed, the content like the bars, lines, figures in all dependent panels got clear out and wait for data, which may take > 10s, the panel content will then show up after > 10s of blank panel, can this behavior change in configuration or coding?

Highlighted

Re: Splunk panel refresh in background or don't clear the panel before refreshing?

Path Finder

Are all your 60 panels visible at one single instance?

0 Karma
Highlighted

Re: Splunk panel refresh in background or don't clear the panel before refreshing?

Explorer

Yes, but it is not about the number of panels, but the behavior of panel updating. Whenever a search token changes, the lines / bars / pies will firstly disappeared, then run the search, and re-draw after the result arrive.
Is there any method to DON'T clear the lines / bars / pies until the new set of data is ready, and just redraw the data instead of showing "waiting for data"?

Edit: For example, Grafana's visualization will show a spinner at the corner of the panel while keeping the content, then refresh the content with the new data, instead of clear the panel.

0 Karma
Highlighted

Re: Splunk panel refresh in background or don't clear the panel before refreshing?

Champion

@lazyfai - tried tinkering with the panel settings for the dependent ones?
edit the search query in the panel and choose refresh indicator as none ?

0 Karma
Highlighted

Re: Splunk panel refresh in background or don't clear the panel before refreshing?

Explorer

@Sukisen1981 No luck, it seemed to be related to token.
I use a token (which change over time, eg. per few minutes) in the base search, and then another token in post process. Whenever the token in base search changed, all dependent panels display "search cancelled" and then "waiting for data" and finally show the data.
What I want is that the panel should keep the data until the new data is ready, and refresh the panel, instead of firstly clear the display and "waiting for data".

0 Karma
Highlighted

Re: Splunk panel refresh in background or don't clear the panel before refreshing?

Explorer

demo video https://youtu.be/qSI_4uMYDxY
A demo video showing the issue. I have 4 base searches queries for 4 time series data, and in each orange square there are 4 post process queries to filter out the related application (name on top left corner)
Every time the base search token changed, all graphs show waiting for data instead of update the graph after search.

0 Karma