Populate initial realtime chart with historical data.

[phoenixdigital]

Hi All,

I understand that real time charting works on data as it arrives so you will not see anything on the chart until the data arrives.

My question is is it possible to initially populate the chart with historical data so the user can at least see something.

For example we have a chart which displays the price of a particular item. New data arrives approximately every 5 minutes. Now if the user opens up this 'real time' dashboard they may see nothing for at least 5 minutes.

The user wants to basically have this screen open all the time and have the new data come in and update the chart. However it would be nice to at least pre-populate the chart for them.

The only solution I can see for this is to just not use realtime and have the whole dashboard refresh every 1-2 minutes.

btw I have tried changing earliest to -30m but Splunk borks at it

ie.
earliest=-1h
latest=rt

Thanks

[sideview]

what you should do, assuming you're running Splunk 4.2, is save the real time search such that it runs in the background.

Run the search in the charting view, or the flashtimeline view, click 'add to dashboard'. Then as you're going through the dashboard wizard, note the option "run this search in the background". Choose that option.

What this does, is that instead of a new search being kicked off every time a user comes to the dashboard, one copy of the search will be running on the whole system. When each user comes to the dashboard, that one set of search results will load there and since it's been running the whole time, the entire windowed time range will be populated in the chart. Note that if you're going to set up a lot of these, you'll want to read more about the performance implications.

http://www.splunk.com/base/Documentation/latest/User/Realtimesearch

[gkanapathy]

Yes, this is the best solution for now. It keeps the chart full until the server restarts, which is a lot better than having to start it over whenever a page reloads.

[gkanapathy · Accepted solution]

There's not really a good way to do it in the current version. It is a fairly high priority enhancement request, however, and therefore likely to make it into a future release.

[phoenixdigital]

Thanks for the reply. I suppose the best method is to just refresh the page every few minutes. Hopefully they release an update with this soon. That would make Splunk unstoppable.