Dashboards & Visualizations

Splunk panel refresh in background or don't clear the panel before refreshing?

lazyfai
Explorer

My splunk dashboard has ~60 panels based on a few (~5) base searches and a post processing for each panel.

Whenever the base search is refreshed, the content like the bars, lines, figures in all dependent panels got clear out and wait for data, which may take > 10s, the panel content will then show up after > 10s of blank panel, can this behavior change in configuration or coding?

TylerP
Observer

Was there answer for this one? I'm experiencing a similar issue. 

0 Karma

lazyfai
Explorer

demo video https://youtu.be/qSI_4uMYDxY
A demo video showing the issue. I have 4 base searches queries for 4 time series data, and in each orange square there are 4 post process queries to filter out the related application (name on top left corner)
Every time the base search token changed, all graphs show waiting for data instead of update the graph after search.

0 Karma

chinmoya
Communicator

Are all your 60 panels visible at one single instance?

0 Karma

lazyfai
Explorer

Yes, but it is not about the number of panels, but the behavior of panel updating. Whenever a search token changes, the lines / bars / pies will firstly disappeared, then run the search, and re-draw after the result arrive.
Is there any method to DON'T clear the lines / bars / pies until the new set of data is ready, and just redraw the data instead of showing "waiting for data"?

Edit: For example, Grafana's visualization will show a spinner at the corner of the panel while keeping the content, then refresh the content with the new data, instead of clear the panel.

0 Karma

Sukisen1981
Champion

@lazyfai - tried tinkering with the panel settings for the dependent ones?
edit the search query in the panel and choose refresh indicator as none ?

0 Karma

lazyfai
Explorer

@Sukisen1981 No luck, it seemed to be related to token.
I use a token (which change over time, eg. per few minutes) in the base search, and then another token in post process. Whenever the token in base search changed, all dependent panels display "search cancelled" and then "waiting for data" and finally show the data.
What I want is that the panel should keep the data until the new data is ready, and refresh the panel, instead of firstly clear the display and "waiting for data".

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...