Refine your search:

hi,

Is it possible to do this? I've a dashboard that hosts 4 searches/reports, my requirement is to refresh those reports every 5 seconds. I know I can auto refresh the entire dashboard, but can I auto refresh the reports themselves? thx

ps, each report contains different events from the last one hr.

asked 16 Apr '12, 15:44

sou128's gravatar image

sou128
614
accept rate: 0%


One Answer:

You might consider changing each report to a real-time search, if you're really running things every 5 seconds over the past hour. That will update continuously, and may put less search load on the system.

link

answered 16 Apr '12, 16:09

gkanapathy's gravatar image

gkanapathy ♦
32.4k4827
accept rate: 41%

I tried using real-time search in my dashboard xml like so:

<module name="HiddenSearch" autorun="True"> <param name="search">source="C:\tmp\log4j2.log" userlogin bam</param> <param name="earliest">rt-5s</param> <!-- my attempt to auto-refresh every 5 seconds <param name="latest">rt</param>

but the results didn't include events within the hour, only the past 5 seconds. any pointers ? thx

(16 Apr '12, 16:22) sou128
Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×1,651
×1

Asked: 16 Apr '12, 15:44

Seen: 550 times

Last updated: 16 Apr '12, 16:23

Copyright © 2005-2012 Splunk Inc. All rights reserved.