One more important option for your dashboards is the Autorun setting. Prior versions of Splunk included a checkbox on the edit dashboard page, as is seen in the following screenshot:
In version 7.0 and newer, Autorun is set within the dashboard source. When you add fields to submit values (for the search string in a panel, as we did in our example), the Autorun setting indicates whether the search in the panels of your dashboard should be run upon loading the page. The default is false. This means that the dashboard will load and wait for the user to enter or select a value and click on Submit. Suppose, you'd rather load your dashboard and show data right away using some default or standard value. To do that, we can modify our XML like this:
<fieldset autoRun="true"> <input type="text" token="myyear"><default>2014</default> <label>MyYear</label> </input> </fieldset>
In the preceding code, I've added the Autorun setting to the <fieldset> tag and provided the <default>. When I save my changes, the dashboard will execute (run) the search using the default value (2014) and my dashboard panels will display the results. Of course, the user still has the ability to change the search value and resubmit the query.
Depending upon a variety of factors, this convenience may or may not be a viable option as it would be foolish to rerun a search every time a dashboard loads if the underlying data is slow to change. In that case, a better option would be to set Autorun to false and perhaps use scheduled searches, which we will discuss in the next section.