Splunk Search

Can't get tag to work

New Member

I have a dashboard with several prebuilt panels and several non-prebuilt panels.

At the top of the form I have:

<input type="dropdown" token="refresh" searchWhenChanged="true">
  <choice value="60">1 minute</choice>
  <choice value="300">5 minutes</choice>
  <choice value="600">10 minutes</choice>
  <choice value="900">15 minutes</choice>
  <choice value="0">Never</choice>

For the value attribute I have tried integers (as above) and SPL time formats (e.g. 5m).

Within various searches in both prebuilt and non-prebuilt panels I have added:


shown in several online postings as well as the documentation for our version of Splunk: 6.6.2, build 4b804538c686.

Nothing I have tried seems to work as I expect. The prebuilt panels run once and stop. The non-prebuilt panels refresh every minute. I think (it's a little hard to tell by hovering over the little controls).

Am I doing something wrong here? I have other dropdowns on the page that work, and the variables defined by those dropdowns interpolate in the prebuilt panels. If I add $refresh$ to a panel title it shows up just as I expect.

As far as I can tell the tag does not work, or at least it does not work as I expect. I have tried constants in it and they don't seem to change anything. Then once in a while it surprises me in some non-reproducible way.

Can someone tell me what I'm doing wrong?

0 Karma


@madkins23, seems like you missed adding s for seconds in all the choices. Like 1 minute = 60s. Following run anywhere dashboard works fine for me. Also I changed Never to empty value rather than a number.

  <label>Dynamic Refresh</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="refresh" searchWhenChanged="true">
      <choice value="60s">1 minute</choice>
      <choice value="300s">5 minutes</choice>
      <choice value="600s">10 minutes</choice>
      <choice value="900s">15 minutes</choice>
      <choice value="">Never</choice>
          <query>index=_internal sourcetype=splunkd
          | timechart count</query>
        <option name="drilldown">all</option>
        <option name="refresh.display">progressbar</option>

Also if your intent is to control the refresh of entire dashboard you can do the same with JavaScript by coding form refresh time.

| makeresults | eval message= "Happy Splunking!!!"
0 Karma