Splunk Search

How can I stop results in dashboard from populating until the search has completed?

DPWSplunkPOC
Explorer

User's are sharing the data populated in the dashboard before search finishes running. I would like to stop Splunk from showing the results in a dashboard until the search has completed. Is this possible?

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

I would probably display a "progress" indicator on the panel, then cause it to disappear when "done".

Exact method depends on exactly what you are returning. Look at the "done" element of the search, and the "rejects" element of the panel. Basically, have something that is listed in the rejects for the panel (for instance "WaitForSearch"), define (set) that something when the search launches and then undefine it (unset) when you reach the "done" for the search.

See the Search Event Handlers section of this page - http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/EventHandlerReference#Search_event_handlers

See also http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/tokens#Custom_logic_for_dashboard_eval_express...

0 Karma

kmccririe_splun
Splunk Employee
Splunk Employee
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...