Within the Splunk Web Framework there needs to be a click:label event that is fired everytime a label is clicked on a chart. When there are very small slivers of a pie chart for example or on a bar chart the slivers may not be there if the number is small enough. It would be much easier to fire off an event based on the word that stays the same size. This may be in d3.js charts, but I think it would be a great addition to the oob django charts. ... View more

I have caching turned on for my searches within a dashboard using Django and Web Framework and when I switched my time picker to realtime within an amount less than the cache time, it appears to continuously run the queries even though I have completely exited the dashboard. These queries will run forever until manually stopped since they will never elapse their cache time. I do believe this is a bug. Here is a small sample. in the timerange dropdown, select a minute to see issue. {% timerange id="activitysummary-timerange" preset="Last 30 days" %} {% chart id="sizesegment-piechart" managerid="sizesegment-piechart-search" drilldown="all" drilldownRedirect=False resizable=True type="pie" %} {% searchmanager autotstart=True id="sizesegment-piechart-search" search="index=myIndex CallingApplication=DP | top limit=10 SizeSegmentID"|token_safe preview=True cache=120 %} Then in javascript. activitysummarytimerange.on("change", function () { sizesegmentpiechartsearch.search.set(activitysummarytimerange.val()); }); So cache is set to expire in 120 seconds.. but since the search includes the realtime of 60 seconds.. the search refreshes itself and will expire in 120 seconds.. then 60 seconds later refreshes itself.. and will be set to expire in 120 seconds.. Even after leaving the dashboard this will continue. The expiry date gets reset to 120 seconds later every 60 seconds. Alternatively you could set the realtime to above 120 seconds... So cache is set to expire in 120 seconds.. since the search includes the realtime of 140 seconds.. It will expire after 120 seconds and refresh in 140 seconds which will then refresh the cache.. as long as you are on the dashboard. So one expires.. and the other does not. If i go into activity -> jobs.. here is what i see after several minutes after leaving the dashboard.. cache=120 and time dropdown was set to realtime 30 seconds.. Dispatched at: 1/21/14 3:06:23 PM Owner: myself Size: .35MB Events: 0 Run time: 00:17:31 Expires: Jan 21, 2014 3:33:54 PM Status: Running(100%) if i refresh the screen.. i now see the following: Dispatched at: 1/21/14 3:06:23 PM Owner: myself Size: .35MB Events: 0 Run time: 00:18:21 Expires: Jan 21, 2014 3:34:45 PM Status: Running(100%) The Expiry date gets later and later and the run time gets longer and longer. for something that should have expired after 120 seconds. Now I've gone back into the dashboard and set the realtime amount to 60 seconds(cache is still 120), left the dashboard and waited a few minutes.. now every search is showing up twice in there.. to run forever. Have gone back in the next morning and the one with cache=120 and 30 seconds realtime is up to 17 hours. ... View more