Splunk Search

How can I stop results in dashboard from populating until the search has completed?

Explorer

User's are sharing the data populated in the dashboard before search finishes running. I would like to stop Splunk from showing the results in a dashboard until the search has completed. Is this possible?

0 Karma

SplunkTrust
SplunkTrust

I would probably display a "progress" indicator on the panel, then cause it to disappear when "done".

Exact method depends on exactly what you are returning. Look at the "done" element of the search, and the "rejects" element of the panel. Basically, have something that is listed in the rejects for the panel (for instance "WaitForSearch"), define (set) that something when the search launches and then undefine it (unset) when you reach the "done" for the search.

See the Search Event Handlers section of this page - http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/EventHandlerReference#Search_event_handlers

See also http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/tokens#Custom_logic_for_dashboard_eval_express...

0 Karma

Splunk Employee
Splunk Employee
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!