Splunk Search

How can I stop results in dashboard from populating until the search has completed?

DPWSplunkPOC
Explorer

User's are sharing the data populated in the dashboard before search finishes running. I would like to stop Splunk from showing the results in a dashboard until the search has completed. Is this possible?

0 Karma

DalJeanis
Legend

I would probably display a "progress" indicator on the panel, then cause it to disappear when "done".

Exact method depends on exactly what you are returning. Look at the "done" element of the search, and the "rejects" element of the panel. Basically, have something that is listed in the rejects for the panel (for instance "WaitForSearch"), define (set) that something when the search launches and then undefine it (unset) when you reach the "done" for the search.

See the Search Event Handlers section of this page - http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/EventHandlerReference#Search_event_handlers

See also http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/tokens#Custom_logic_for_dashboard_eval_express...

0 Karma

kmccririe_splun
Splunk Employee
Splunk Employee
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...