Splunk Search

Can't get tag to work

New Member

I have a dashboard with several prebuilt panels and several non-prebuilt panels.

At the top of the form I have:

<input type="dropdown" token="refresh" searchWhenChanged="true">
  <choice value="60">1 minute</choice>
  <choice value="300">5 minutes</choice>
  <choice value="600">10 minutes</choice>
  <choice value="900">15 minutes</choice>
  <choice value="0">Never</choice>

For the value attribute I have tried integers (as above) and SPL time formats (e.g. 5m).

Within various searches in both prebuilt and non-prebuilt panels I have added:


shown in several online postings as well as the documentation for our version of Splunk: 6.6.2, build 4b804538c686.

Nothing I have tried seems to work as I expect. The prebuilt panels run once and stop. The non-prebuilt panels refresh every minute. I think (it's a little hard to tell by hovering over the little controls).

Am I doing something wrong here? I have other dropdowns on the page that work, and the variables defined by those dropdowns interpolate in the prebuilt panels. If I add $refresh$ to a panel title it shows up just as I expect.

As far as I can tell the tag does not work, or at least it does not work as I expect. I have tried constants in it and they don't seem to change anything. Then once in a while it surprises me in some non-reproducible way.

Can someone tell me what I'm doing wrong?

0 Karma


@madkins23, seems like you missed adding s for seconds in all the choices. Like 1 minute = 60s. Following run anywhere dashboard works fine for me. Also I changed Never to empty value rather than a number.

  <label>Dynamic Refresh</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="refresh" searchWhenChanged="true">
      <choice value="60s">1 minute</choice>
      <choice value="300s">5 minutes</choice>
      <choice value="600s">10 minutes</choice>
      <choice value="900s">15 minutes</choice>
      <choice value="">Never</choice>
          <query>index=_internal sourcetype=splunkd
          | timechart count</query>
        <option name="drilldown">all</option>
        <option name="refresh.display">progressbar</option>

Also if your intent is to control the refresh of entire dashboard you can do the same with JavaScript by coding form refresh time.

| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...