I wanted to add a new solution to this as the option refresh.auto.interval is now deprecated. There is now a child element of refresh (https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#search) to do this sort of thing. However I needed (and saw other questions) asking for a refresh button (large and obvious to end user) to refresh a single panel, I have found a way to do this with Simple XML with a single option link list input and some token management. The form.refresh is unset using the progress child element so the user can refresh over and over. Below is an example dashboard of how to do so:
<form>
<label>Refresh Panel Test</label>
<fieldset submitButton="false"></fieldset>
<row>
<panel>
<input type="link" token="refresh">
<label></label>
<choice value="Yes">Refresh?</choice>
<change>
<condition value="Yes">
<set token="refresh_delay">1</set>
</condition>
</change>
</input>
<table>
<search>
<progress>
<unset token="refresh_delay"></unset>
<unset token="form.refresh"></unset>
</progress>
<query>| tstats count where index=_internal by source host
| sort -count</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
<refresh>$refresh_delay$</refresh>
<refreshType>delay</refreshType>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
One problem with the link list input is it makes a gigantic empty space, that isn't terribly effiecient or obvious:
By adding an id to the input and some css this can be fixed like so (dashboard with stylesheet and id):
<form stylesheet="slim_input.css">
<label>Refresh Panel Test</label>
<fieldset submitButton="false"></fieldset>
<row>
<panel>
<input type="link" token="refresh" id="slim_input>
<label></label>
<choice value="Yes">Refresh?</choice>
<change>
<condition value="Yes">
<set token="refresh_delay">1</set>
</condition>
</change>
</input>
<table>
<search>
<progress>
<unset token="refresh_delay"></unset>
<unset token="form.refresh"></unset>
</progress>
<query>| tstats count where index=_internal by source host
| sort -count</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
<refresh>$refresh_delay$</refresh>
<refreshType>delay</refreshType>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
Then the slim_input.css file:
#slim_input {
display: inline-flex;
}
#slim_input button {
background-color: #4608A5;
color: #fff
}
#slim_input label, #slim_input .splunk-choice-input-message{
display: none;
}
Now we get a nice purple button that refreshes the given panel:
... View more
