0

I am using Splunk community edition for a monitoring dashboard. I display a page of real time charts, I refresh the browser every now and then via a script.

This all works well however I am looking for a way to finalize and delete jobs running in the background as there is a limit as to how many live charts one can display in the community edition and when it refreshes the browser it seems to run to the limit after a while.

Thus how can I schedule the finalizing and deleting of the old jobs? (possibly a file I can remove from time to time)

Bluedevil678
  • 120
  • 1
  • 10
  • If it's a real-time view, then why do you need to refresh? Also the whole point of a real-time view is that someone is actually staring at the page. If no one is looking at it then you are just wasting CPU for leaving the views opened. – hobbes3 Mar 05 '14 at 00:35
  • There are times when the display items stop refreshing due to an internal page crash on the browser, thus the refreshing. Displaying via a Raspberry Pi using Chromium, used midori in the past however it did not last long due to continual crashes. – Bluedevil678 Mar 06 '14 at 06:30
  • Sounds like you have non-Splunk related problems. But if you want to manually delete old jobs, then they can be found at `$SPLUNK_HOME/var/run/splunk/dispatch/`. The GUI way would be to remove them from the Jobs Activity. – hobbes3 Mar 11 '14 at 23:36

1 Answers1

0

I've overcame it by putting this at the top of my dashboard view (surrounded by XML tags):

< view autoCancelInterval="5" template="dashboard.html" >

The auto-cancel interval is set to 5 seconds. This means that when the search becomes inactive for 5 seconds or more, it will automatically cancel the search from running.

Bluedevil678
  • 120
  • 1
  • 10