Is it possible to refresh a single module on a dashboard?
A client is interested in having a single dashboard with half static, backward looking charts, and half real-time, forward looking charts. They want to refresh the static ones every so often without losing the real-time graphs' history.
Another option is to add a custom module to splunk that can refresh periodically. Let's call the module AutoRefresh. To do this you have to create the following directory structure (in an app, eg. search or better a custom one):
Once you've added those folders and files you have to restart Splunk. Then you'll be able to use the module in your advanced xml views like this:
In this example all (search-)descendants of the AutoRefresh module would be refresh every 10 seconds.
answered 30 Jun '10, 22:38
Yep, it can be done if you're using the advanced XML.
I cant think of an app offhand that does it but im sure there is one. You just put a SubmitButton module into the XML as follows:
2) same panel, but with a SubmitButton
Make sure that the module tag for the SubmitButton encloses the FlashChart module and also that it encloses any other modules that will be displaying data for this particular job -- most typically headers. As is always the case with the containment of module tags, if someone isnt enclosed by a module, then they know nothing about that module. So in this example if a SimpleResultsHeader is not enclosed by the SubmitButton, then it wont be refreshed when users click on it.
This seems like the most obvious place to post this.
HiddenSavedSearches are not refreshed by AutoRefresh, this is because the search is defined when the page loads, and isn't changed by pushContextToChildren().
This cobbled together Module, when used in place of HiddenSavedSearch works around that problem. Obviously you still need AutoRefresh upstream.
Credit goes to sideview for the pointers along the way
The controller module is a straight copy of HiddenSearchSwapper, as is the ajax call in the js file