Splunk Search

Real-time Dashboard

Contributor

Hi~there

Does anyone know if real-time search on dashboard can display last accumulated results such as last -1h when entering the view(for graph or resulting table), because i found every time i enter the dashboard, it run the search from that time. That is to say it accumulate from zero result(like non-schedule saved search). we use vesion 4.1.8

Thanks in advance.

Tags (1)
0 Karma
1 Solution

Legend

No, not currently possible, though there are workarounds that you can try. See the answers to this question: http://splunk-base.splunk.com/answers/24641/populate-initial-realtime-chart-with-historical-data

View solution in original post

0 Karma

Legend

No, not currently possible, though there are workarounds that you can try. See the answers to this question: http://splunk-base.splunk.com/answers/24641/populate-initial-realtime-chart-with-historical-data

View solution in original post

0 Karma

Contributor

I got it, thanks

0 Karma