Splunk Search

How to create dashboards so they update/refresh search results?

CREVITCH
Path Finder

I save dashboards from both search and report, and it appears that the dashboards run the search every time it is brought up, but does not refresh after that. I have read that it is supposed to display the cached search. What is the proper way to create dashboards so that they update properly. Is there a way to do this from Splunk Web or only in XML?

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Save your searches as reports (saved searches) and use the saved search name in your dashboards. The results of a saved search are kept in the dispatch directory for twice as long as your search timeframe, i.e. if you search over the past 4 hours, search results will be cached for 8 hours (by default) before being reaped.
Not sure what you meant with your second question in your comment.

0 Karma

CREVITCH
Path Finder

also is there any way to just display the results of an alert on a dashboard? The schedule is already in the alert. It would be nice to just display the results rather than create a new search.

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...