Splunk Search

Can't get tag to work

madkins23
New Member

I have a dashboard with several prebuilt panels and several non-prebuilt panels.

At the top of the form I have:

<input type="dropdown" token="refresh" searchWhenChanged="true">
  <label>Refresh</label>
  <choice value="60">1 minute</choice>
  <choice value="300">5 minutes</choice>
  <choice value="600">10 minutes</choice>
  <choice value="900">15 minutes</choice>
  <choice value="0">Never</choice>
  <default>Never</default>
</input>

For the value attribute I have tried integers (as above) and SPL time formats (e.g. 5m).

Within various searches in both prebuilt and non-prebuilt panels I have added:

  <refresh>$refresh$</refresh>
</search>

shown in several online postings as well as the documentation for our version of Splunk: 6.6.2, build 4b804538c686.

Nothing I have tried seems to work as I expect. The prebuilt panels run once and stop. The non-prebuilt panels refresh every minute. I think (it's a little hard to tell by hovering over the little controls).

Am I doing something wrong here? I have other dropdowns on the page that work, and the variables defined by those dropdowns interpolate in the prebuilt panels. If I add $refresh$ to a panel title it shows up just as I expect.

As far as I can tell the tag does not work, or at least it does not work as I expect. I have tried constants in it and they don't seem to change anything. Then once in a while it surprises me in some non-reproducible way.

Can someone tell me what I'm doing wrong?

0 Karma

niketn
Legend

@madkins23, seems like you missed adding s for seconds in all the choices. Like 1 minute = 60s. Following run anywhere dashboard works fine for me. Also I changed Never to empty value rather than a number.

<form>
  <label>Dynamic Refresh</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="refresh" searchWhenChanged="true">
      <label>Refresh</label>
      <choice value="60s">1 minute</choice>
      <choice value="300s">5 minutes</choice>
      <choice value="600s">10 minutes</choice>
      <choice value="900s">15 minutes</choice>
      <choice value="">Never</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <search>
          <query>index=_internal sourcetype=splunkd
          | timechart count</query>
          <earliest>-24h</earliest>
          <latest>now</latest>
          <refresh>$refresh$</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="drilldown">all</option>
        <option name="refresh.display">progressbar</option>
      </single>
    </panel>
  </row>
</form>

Also if your intent is to control the refresh of entire dashboard you can do the same with JavaScript by coding form refresh time.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...