topic Re: Is it possible to use a scheduled report as the base search in a dashboard? in Dashboards & Visualizations

Is it possible to use a scheduled report as the base search in a dashboard?

sylbaea — Tue, 22 Nov 2016 15:39:26 GMT

Hello,

I am using Splunk 6.5

I would like to leverage scheduled report capability to speed up dashboard rendering.

I have a complex report making a search like search (...) | table A, B, C where (...) is a complex query made of dedup, lookup, eval, etc. commands.
I scheduled this report to be computed every hour
I check I get the expected result
Then I try to define this scheduled search as parent search of a dashboard like following...
```
<form>
  <search id="CurrentTickets" ref="my report">
  </search>
    (...)
          <single>
        <search base="CurrentTickets">
          <query>stats count by A</query>
        </search>
      </single>
    (...)
```
When I try to display the dashboard, it does not display anything (trying to search forever).
On the other hand, if I replace the parent search by:

search (...) | table A, B, C

In this case, it displays as expected, but of course not with the expected performance as it does computer real-time my search.

Is it possible to combine a scheduled report with parent search concept?

Regards.

Sylvain

Re: Is it possible to use a scheduled report as the base search in a dashboard?

cmerriman — Tue, 22 Nov 2016 16:10:18 GMT

try adding a query tag:

<search id="CurrentTickets" ref="my report">
<query> fields *</query>
       </search>

Re: Is it possible to use a scheduled report as the base search in a dashboard?

sylbaea — Tue, 22 Nov 2016 16:22:35 GMT

Thanks for the suggestion... Strangely, with this change, the panels in the dashboard starts to render their content but very very slow, even slower than when the search is executed live.

Re: Is it possible to use a scheduled report as the base search in a dashboard?

cmerriman — Tue, 22 Nov 2016 16:42:12 GMT

possibly try to do a fields a, b, c instead of fields * in case it's bringing back unexpected fields?

Re: Is it possible to use a scheduled report as the base search in a dashboard?

sylbaea — Wed, 23 Nov 2016 04:27:20 GMT

I tried, same result unfortunately.

Re: Is it possible to use a scheduled report as the base search in a dashboard?

rlacher — Tue, 20 Dec 2016 02:39:01 GMT

I was Googling around for this same thing and found your post. Swapping ref and id worked for me, strangely.

<search ref="my report" id="CurrentTickets">
    <earliest>$TOKEN_TIME.earliest$</earliest>
    <latest>$TOKEN_TIME.latest$</latest>
</search>

I tried using query tags as well per cmerriman's answer, but the search wouldn't fire off until I removed them.

Re: Is it possible to use a scheduled report as the base search in a dashboard?

robertlynch2020 — Sat, 09 Mar 2019 20:13:32 GMT

did you get this to work in the end?