Splunk Search

Realtime single value panel and live gauges not updating

phoenixdigital
Builder

So I have created some single values and gauges which I hope to update with live data. However they dont seem to update and there is new data coming in every 15 seconds.

Single Value


<single>
                <searchString>host="jacona" SPLUNK:ChkInpReg regName=GensetRPM | head 1 | rangemap field=val low=0-30000 severe=30000-100000 | fields val, range</searchString>
                <title>Station State</title>
                <option name="field">val</option>
                <option name="classField">range</option>
                <earliestTime>rt</earliestTime>
                <latestTime>rt</latestTime>

</single>

The Gauge Here


        <chart>
                <title>Station Output</title>
                <searchTemplate>host="jacona" SPLUNK:ChkInpReg regName=GensetRPM  | gauge val 0 10000 25000 33000</searchTemplate>
                <option name="charting.chart">radialGauge</option>
                <option name="charting.chart.rangeValues">[0,30,70,100]</option>
                <option name="charting.gaugeColors">[0xBF3030,0xFFE800,0x84E900]</option>
                <earliestTime>rt</earliestTime>
                <latestTime>rt</latestTime>
        </chart>

Anyone have any thoughts?

0 Karma
1 Solution

hazekamp
Builder

I would recommend adjusting earliestTime values to create a real-time time window. This helps Splunk collect real-time events with drift between indextime and _time.

Try:

<earliestTime>rt-5m</earliestTime>
<latestTime>rt</latestTime>

Update:
Glad this worked. If you would like to always have the latest event consider adding the
"head"
command.

<your search> | head 1

View solution in original post

hazekamp
Builder

I would recommend adjusting earliestTime values to create a real-time time window. This helps Splunk collect real-time events with drift between indextime and _time.

Try:

<earliestTime>rt-5m</earliestTime>
<latestTime>rt</latestTime>

Update:
Glad this worked. If you would like to always have the latest event consider adding the
"head"
command.

<your search> | head 1

jflomenberg
Splunk Employee
Splunk Employee

In 4.2 the only way you can do this is by scheduling the underlying search to run all the time in the background (step 2 in the add to dashboard workflow for rt search)

0 Karma

phoenixdigital
Builder

Ignore that it is updating live now. Thanks heaps for your suggestion.

Another small question is there any way possible to have these 'realtime' gauges start with the most recent value in splunk instead of waiting for the first data point?

Also with 'realtime' charts can you have it show live data but start with the last 30 minutes?

0 Karma

phoenixdigital
Builder

Closer....

That displays the result thanks however the gauge never changes after that even though I know the data is incrementing every second and being logged every 15 seconds.

I watched it for about 10 minutes

0 Karma

phoenixdigital
Builder

Here is an example line

May 13 12:41:25 jacona power-engine[32525]: SPLUNK:ChkInpReg, regName=GensetRPM, reg=7, val=3668

Also just to mention these gauges and single values display fine when not attempting realtime.

0 Karma

jflomenberg
Splunk Employee
Splunk Employee

Can you provide a sample log line and show us where you are setting 'val'?

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...