Splunk Search

How can I stop results in dashboard from populating until the search has completed?

DPWSplunkPOC
Explorer

User's are sharing the data populated in the dashboard before search finishes running. I would like to stop Splunk from showing the results in a dashboard until the search has completed. Is this possible?

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

I would probably display a "progress" indicator on the panel, then cause it to disappear when "done".

Exact method depends on exactly what you are returning. Look at the "done" element of the search, and the "rejects" element of the panel. Basically, have something that is listed in the rejects for the panel (for instance "WaitForSearch"), define (set) that something when the search launches and then undefine it (unset) when you reach the "done" for the search.

See the Search Event Handlers section of this page - http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/EventHandlerReference#Search_event_handlers

See also http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/tokens#Custom_logic_for_dashboard_eval_express...

0 Karma

kmccririe_splun
Splunk Employee
Splunk Employee
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!