We got a requirement to auto-refresh the panels. The underlying search are "SavedSearch" results.
But I'm not able to get the Autorefresh-Postprocess-SavedSearch combo to work. I've also tried HiddenSavedSearch. Below snippet is what I did. Any ideas to get SavedSearch to be autorefreshed?
index="_internal" earliest=-5m | stats count by sourcetype, host
at last found a way.. But let me explain what all things I tried first
- Tried: Splunk native autorefresh. It works, but only at "View/Dashboard" level (ie whole page refreshes)
- Tried: Sideviewutils . Couldn't make it to work with SavedSearch.
- Tried: used "|savedsearch mySavedSearchName | ..." . It works, but won't get benefit of savedsearch as it runs from scratch.
- used "loadjob" as per this example. It works, but a pain to migrate systems as the username/appnames won't be consistent.
- Best solution for me: Used DynamicHiddenSavedSearch module from "Dynamic Dashboard Panel Refresh" App. Link here . I have added the contents into /appserver/modules , restart splunk. In your advanced XML use: