Splunk® Enterprise

Developing Dashboards, Views, and Apps for Splunk Web

Download manual as PDF

Splunk version 4.x reached its End of Life on October 1, 2013. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Build a real-time dashboard

You can build a real-time dashboard using the Splunk Dashboard Editor, coding the dashboard using Simplified XML, or using Splunk's Advanced XML. This topic provides an example of creating a real-time dashboard using Simplified XML.

For information on building a dashboard using Advanced XML, see "How to build a real-time dashboard" in the Advanced Web customization section of this manual.

Enable real-time searching

Use the <earliestTime> and <latestTime> params to enable real-time searching. For example, if you want to enable real-time searching and display the data in a table, specify the following:

<table>
    <title>Look here for errors that you need to care about</title>
    <searchName>Errors in the last 24 hours</searchName>
    <fields>host, source, errorNumber</fields>
    <earliestTime>rt</earliestTime>
    <latestTime>rt</latestTime>
</table>

You can also set a window for your real-time dashboard. For example, if you want to show real-time events but only from the last 5 minutes.

<table>
    <title>Look here for errors that you need to care about</title>
    <searchName>Errors in the last 24 hours</searchName>
    <fields>host, source, errorNumber</fields>
    <earliestTime>rt-5m</earliestTime>
    <latestTime>rt</latestTime>
</table>

For more information on setting a search window, see "The real-time search topic" in the User Manual.

PREVIOUS
Add an event listing
  NEXT
Dashboard example

This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters