Real-time Dashboard

[hjwang]

Hi~there

Does anyone know if real-time search on dashboard can display last accumulated results such as last -1h when entering the view(for graph or resulting table), because i found every time i enter the dashboard, it run the search from that time. That is to say it accumulate from zero result(like non-schedule saved search). we use vesion 4.1.8

Thanks in advance.

[Ayn · Accepted solution]

No, not currently possible, though there are workarounds that you can try. See the answers to this question: http://splunk-base.splunk.com/answers/24641/populate-initial-realtime-chart-with-historical-data

[hjwang]

I got it, thanks