Dashboards & Visualizations

Steps to setup live dashboard

tb5821
Communicator

I currently have my dashboard setup so that it runs every time its loaded but I'd like for it to be live dashboard and not need a refresh when I want more up-to-date data. I'm running 5.0.4, what are the steps I need to take to convert my current dash?

Tags (1)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi tb5821

either you modify your dashboard to reload every other minute by adding

<view refresh="60" template="dashboard.html">

or you modify your searches used in the dashboard to be real-time searches by adding

earliest=rt-5m latest=rt

to your searches. This will perform a real-time search over the last 5 minutes and will display the search result continuously in real-time.

Find more about real-time dashboards in the docs

hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi tb5821

either you modify your dashboard to reload every other minute by adding

<view refresh="60" template="dashboard.html">

or you modify your searches used in the dashboard to be real-time searches by adding

earliest=rt-5m latest=rt

to your searches. This will perform a real-time search over the last 5 minutes and will display the search result continuously in real-time.

Find more about real-time dashboards in the docs

hope this helps ...

cheers, MuS

tb5821
Communicator

Thanks I ended up using the earliest/latest params.

0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...