Splunk Search

How to re-run a relative time search on click of the submit button?

helenashton
Path Finder

How to re-run a relative time search of the last 15 minutes on click of the submit button and refresh with the updated time?

I am using Simple XML (with JS) and I have a lot of dashboards which do searches (with various input) based on relative times (i.e. last 15 minutes). Say we ran the search 10 minutes ago (for the last 15 mins), and now we want to see the results for the last 15 minutes again, and so no input changes, but we want the search to run again and new results populate.

I have tried this with a submit button, but it doesn't look like the search re-runs.

Thanks in advance.

nick405060
Motivator

https://answers.splunk.com/answers/758332/is-it-impossible-to-resubmit-a-dashboard-search-in.html

I cannot believe you're the only one who has had this issue besides me. It is really not too much to ask for this functionality. The entire point of a dashboard is to have a tool to be able to do stuff like this.

0 Karma

masonmorales
Influencer

I've encountered this in the past, and I don't think there is a way to do a soft refresh on-demand from the GUI. You could either have your users hit refresh (F5), or you could implement an auto-refresh in your dashboard tag. Example below (value in seconds).

<dashboard refresh="300"> 

helenashton
Path Finder

I guess the F5 might be the only option - refresh interval is not predictable, and need to keep all form input intact.

Shame 😞

0 Karma

somesoni2
Revered Legend

Could you post you dashboard xml? Does your dashboard visualization using common/shared Time-range Picker (or do you have a time-range picker)?

0 Karma

helenashton
Path Finder

I have lots of different dashboards. All use the following type of time picker though (simple XML):

and I may have various types of input elements (text, checkboxes, dropdown etc.).

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience

Hey Splunky People! We are excited to share the latest updates in Splunk Enterprise 9.4. In this release we ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...