I have a script that gathers disk freespace metrics and indexes these metrics into splunk every 10 minutes.
This is the dashboard panel I am trying to get to work.
<module name="HiddenSearch" layoutPanel="panel_row2_col1" group="LVM2 Filesystem Capacity" autoRun="True">
<param name="search">sourcetype=scriptlog name=mon-lvm2 | dedup host,filesystem | sort capacity desc | fields host,filesystem,capacity</param>
<param name="latest">rt</param>
<param name="earliest">rt</param>
<module name="EnablePreview">
<param name="enable">true</param>
<param name="display">false</param>
<module name="SimpleResultsTable">
<param name="dataOverlayMode">heatmap</param>
</module>
When I navigate to the dashboard, it hangs at "Waiting for search events..." until the next 10 minute interval. Once this 10 minute interval is reached, it will fill the panel with the proper events. After this it will not update with any new events.
Why does it immediately find the latest events? I.E. I open dashboard at 35 after, and it has to wait until 40 after before it fills the panel. Why doesn't it find the events at 30 after, which is what the simple search would do. When it does fill the table, at 40 after, how come it doesn't update with new events at 50 after?
... View more
