Build a real-time dashboard

Important notice: The Advanced XML dashboard framework is officially deprecated. For more information, see Advanced XML Deprecation.

You can use real-time reporting to show streaming results in dashboards. First, construct a real time search, as described in the real-time search and reporting chapter in the Search Manual. Save this search and add it to your dashboard using the HiddenSavedSearch module.

To enable real-time on your dashboard, add the EnablePreview module to your view XML. For example:

...
<module name="EnablePreview">
  <param name="enable">true</param>
  <param name="display">false</param>
...

If you're building an inline search with the HiddenSearch module, you can specify a sliding window for real-time results by setting the earliest and latest params on your HiddenSearch module. For example, the following sets a five minute window, therefore showing streaming results from the most recent five minutes:

...
<module name="HiddenSearch" autoRun="True">
  <param name="search">host=foo OR bar | top IP</param>
  <param name="earliest">rt-5m</param>
  <param name="latest">rt</param>
...

Example

Here is a complete example. This example sets the real-time window to 30 seconds.

<?xml version="1.0"?>
<view template="dashboard.html">
  <label>Real time example</label>

  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>

  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>

  <module name="TitleBar" layoutPanel="viewHeader">
    <param name="actionsMenuFilter">dashboard</param>
  </module>

  <module name="GenericHeader" layoutPanel="panel_row1_col1" autoRun="True">
    <param name="label">My real time search</param>

      <module name="HiddenSearch" autoRun="True">
        <param name="search">host=foo OR bar | top IP</param>
        <param name="earliest">rt-30s</param>
        <param name="latest">rt</param>

          <module name="EnablePreview">
            <param name="enable">true</param>
            <param name="display">false</param>

              <module name="HiddenChartFormatter">
                <param name="chart">area</param>
                <param name="primaryAxisTitle.text">Time</param>
                <param name="chart.stackMode">default</param>
                <param name="secondaryAxisTitle.text">Count</param>

                  <module name="FlashChart">
                    <param name="width">100%</param>
                    <param name="height">250px</param>
                  </module>

                  <module name="ViewRedirectorLink">
                    <param name="viewTarget">flashtimeline</param>
                    <param name="label">View results</param>
                  </module>

               </module>
            </module>
      </module>
  </module>
</view>