Hello,
I previously posted a question* about Real Time searches, and, thanks to the answers, I was able to achieve what I wanted with my dashboard. However, Real Time searches are expensive. Is there any way to continuously get the current (server) time and use it to perform calculations without performing a Real Time search?
* - Question located at http://answers.splunk.com/answers/484057/continuous-display-of-time-since-event.html
Thanks for your help!
Hi _dave_b,
I I posted in the previous answer, you can also refresh your dashboard: from my experience,, this could be useful under two conditions:
Otherwise, I think that real time searches are the most efficient way to display real time events.
Every way, you can to refresh your dashboard inserting in the <form>
row the refresh time <form refresh="30">
(http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/PanelreferenceforSimplifiedXML#Dashboards_and_...) or only one panel <option name="refresh.auto.interval">60</option>
(http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML).
Bye.
Giuseppe
You should probably switch to alerts...
Did you look at my answer for your previous post where you can use use historical search but refresh every periodic interval like 5 minutes? It was option 2 where you did not have to use Real Time Searches.