I have a dashboard with several prebuilt panels and several non-prebuilt panels.
At the top of the form I have:
1 minute 5 minutes 10 minutes 15 minutes Never Never
For the value attribute I have tried integers (as above) and SPL time formats (e.g. 5m).
Within various searches in both prebuilt and non-prebuilt panels I have added:
$refresh$
shown in several online postings as well as the documentation for our version of Splunk: 6.6.2, build 4b804538c686.
Nothing I have tried seems to work as I expect. The prebuilt panels run once and stop. The non-prebuilt panels refresh every minute. I think (it's a little hard to tell by hovering over the little controls).
Am I doing something wrong here? I have other dropdowns on the page that work, and the variables defined by those dropdowns interpolate in the prebuilt panels. If I add $refresh$ to a panel title it shows up just as I expect.
As far as I can tell the tag does not work, or at least it does not work as I expect. I have tried constants in it and they don't seem to change anything. Then once in a while it surprises me in some non-reproducible way.
Can someone tell me what I'm doing wrong?
↧