Hi folks
We got a requirement to auto-refresh the panels. The underlying search are "SavedSearch" results.
But I'm not able to get the Autorefresh-Postprocess-SavedSearch combo to work. I've also tried HiddenSavedSearch. Below snippet is what I did. Any ideas to get SavedSearch to be autorefreshed?
Sample_Internal_Search
index="_internal" earliest=-5m | stats count by sourcetype, host
SideView SavedSearch - Part1
<module name="AutoRefresh" layoutPanel="panel_row2_col1">
<param name="refreshEvery">30</param>
<module name="SavedSearch" layoutPanel="panel_row2_col1_grp1" autoRun="True">
<param name="name">Sample_Internal_Search</param>
<module name="HiddenPostProcess">
<param name="search"> | stats sum(count) as INTERNALCOUNT</param>
<module name="HTML">
<param name="html"><![CDATA[
<h3>SavedSearch Internal events: $results[0].INTERNALCOUNT$</h3>
]]></param>
</module>
</module>
</module>
Splunk Built-in HiddenSavedSearch - Part2
<module name="HiddenSavedSearch" layoutPanel="panel_row2_col1_grp2" autoRun="True">
<param name="savedSearch">Sample_Internal_Search</param>
<module name="PostProcess">
<param name="search"> | stats sum(count) as INTERNALCOUNT</param>
<module name="HTML">
<param name="html"><![CDATA[
<h3>HiddenSavedSearch Internal events: $results[0].INTERNALCOUNT$</h3>
]]></param>
</module>
</module>
</module>
Normal Search - Part3
<module name="Search" layoutPanel="panel_row2_col1_grp3" autoRun="True">
<param name="search">index="_internal" earliest=-5m | stats count by sourcetype, host</param>
<module name="PostProcess">
<param name="search"> | stats sum(count) as INTERNALCOUNT</param>
<module name="HTML">
<param name="html"><![CDATA[
<h3>Search Internal events: $results[0].INTERNALCOUNT$</h3>
]]></param>
</module>
</module>
</module>
</module>
The normal Search (part3) of XML works perfectly. But the other two values never refreshes. But of course Part3 queries the system everytime per user !!
at last found a way.. But let me explain what all things I tried first
- Tried: Splunk native autorefresh. It works, but only at "View/Dashboard" level (ie whole page refreshes)
- Tried: Sideviewutils
- Tried: used "|savedsearch mySavedSearchName | ..." . It works, but won't get benefit of savedsearch as it runs from scratch.
Working approaches
- used "loadjob" as per this example. It works, but a pain to migrate systems as the username/appnames won't be consistent.
- Best solution for me: Used DynamicHiddenSavedSearch module from "Dynamic Dashboard Panel Refresh" App. Link here . I have added the contents into
<module name="DynamicHiddenSavedSearch" layoutPanel="panel_row3_col1" autoRun="True">
<param name="savedSearch">YourSavedSearchName</param>
<param name="refreshInterval">60</param>
and voilaa!! it worked~!!
at last found a way.. But let me explain what all things I tried first
- Tried: Splunk native autorefresh. It works, but only at "View/Dashboard" level (ie whole page refreshes)
- Tried: Sideviewutils
- Tried: used "|savedsearch mySavedSearchName | ..." . It works, but won't get benefit of savedsearch as it runs from scratch.
Working approaches
- used "loadjob" as per this example. It works, but a pain to migrate systems as the username/appnames won't be consistent.
- Best solution for me: Used DynamicHiddenSavedSearch module from "Dynamic Dashboard Panel Refresh" App. Link here . I have added the contents into
<module name="DynamicHiddenSavedSearch" layoutPanel="panel_row3_col1" autoRun="True">
<param name="savedSearch">YourSavedSearchName</param>
<param name="refreshInterval">60</param>
and voilaa!! it worked~!!