Splunk Search

Display Real Time Calculations Without a Search


I previously posted a question* about Real Time searches, and, thanks to the answers, I was able to achieve what I wanted with my dashboard. However, Real Time searches are expensive. Is there any way to continuously get the current (server) time and use it to perform calculations without performing a Real Time search?

* - Question located at http://answers.splunk.com/answers/484057/continuous-display-of-time-since-event.html

Thanks for your help!

0 Karma


Hi _dave_b,
I I posted in the previous answer, you can also refresh your dashboard: from my experience,, this could be useful under two conditions:

  • if you're using this dashboard for a wallpaper and not for a static dashboard (it's less useful, if you're using a search dashboard, that the dashboard changes when you're see results!),
  • if your search isn't slow.

Otherwise, I think that real time searches are the most efficient way to display real time events.

Every way, you can to refresh your dashboard inserting in the <form> row the refresh time <form refresh="30"> (http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/PanelreferenceforSimplifiedXML#Dashboards_and_...) or only one panel <option name="refresh.auto.interval">60</option>(http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML).


0 Karma

Ultra Champion

You should probably switch to alerts...

0 Karma


Did you look at my answer for your previous post where you can use use historical search but refresh every periodic interval like 5 minutes? It was option 2 where you did not have to use Real Time Searches.

| makeresults | eval message= "Happy Splunking!!!"
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!