Splunk Enterprise

Looking to finalize dashboard panel searches sooner than later

Path Finder

I have dashboard panels which set token values with $result.<field_name>$, however our environment is a little congested and the searches will sit at 99% or 98.9 or 100% but won't actually finalize until maybe 60-90 seconds later. I see the results are there and are what i'm expecting, however the tokens won't set unless the panel searches are finalized.

I've tried placing those tokens in the below 




<condition match="'job.resultCount' &gt; 0">
<set token="abc">$result.field1$</set>
<set token="cba">$result.field2$</set>




but it still waits until the search finalizes before my other panels can utilize those tokens.


is there anyway to finalize panels after a set amount of time with an 'option' tag in the xml? or something?

0 Karma

Path Finder

i think i may have figured it out. i removed my <condition> tags and it just set it as progress took place. dumb me.

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...