topic Re: Why is an embedded report on a webpage not getting updated to reflect the same report shown in Splunk? in Splunk Search

Why is an embedded report on a webpage not getting updated to reflect the same report shown in Splunk?

alexantao — Fri, 13 May 2016 12:52:18 GMT

I have a report scheduled to run everyday at 2:00 AM. It basically creates a line chart to show the WEB traffic in Gigabytes.
It is working perfectly and the schedule is being running, I can access it through "View Recent" link directly in SPLUNK.

The problem is that I embed this same report on a webpage, but the chart that is showing there is outdated by some days.

It is not my browser's cache, since I opened the same page on box that has never opened it.

How can I force the embed report be the same as shown in SPLUNK ?

Thanks.

Re: Why is an embedded report on a webpage not getting updated to reflect the same report shown in Splunk?

jkat54 — Mon, 16 May 2016 15:02:17 GMT

This seems to be a very common issue among those who use embedding. It seemingly updates at random times but that is not the case:

http://docs.splunk.com/Documentation/Splunk/6.1/Report/Embedscheduledreports

Are both computers youre accessing from behind a proxy server? If so, it could still be cache.

You should upvote this comment and file your own feature request / support ticket possibly too:
https://answers.splunk.com/answers/153158/feature-request-how-to-embed-a-dashboard-not-a-rep.html

Re: Why is an embedded report on a webpage not getting updated to reflect the same report shown in Splunk?

jcperrin — Tue, 14 Jun 2016 09:59:32 GMT

FYI we've started a pilot with 10 reports published in a static web page. Reports are based on trivial search request, and rendered as table, pie and line chart. They were first tested in a dashboard, and changed to saved search as documented (report, save, schedule, embded, wait first schedule, copy-paste iframe, test). Scheduling is set to 1 hour for all reports.

Results :
- some reports are refreshed, and some are NOT
- in "Reports" menu, report preview is correct
- in "Settings\Search,reports,alerts", report scheduling is correct
- no error in /opt/splunk/var/log/splunk/scheduler.log

Is there something we didn't understand during configuration? Or is this a know issue?

Does anyone have any positive feedback about using the Reports feature?

PS : using splunk 6.4.0

Re: Why is an embedded report on a webpage not getting updated to reflect the same report shown in Splunk?

rveal — Thu, 16 Jun 2016 06:58:47 GMT

We too are having this problem with Splunk v6.4.1

Report is fine from the reports page, but embed link only shows the report as it was generated when it was first embeded

Re: Why is an embedded report on a webpage not getting updated to reflect the same report shown in Splunk?

arowsell_splunk — Tue, 29 Sep 2020 09:58:02 GMT

I suspect the issue is caused because the embedded report is looking at the oldest copy of the related search artifact, rather than the latest.

For example, if I have an embedded report named "embedtest", which is scheduled to run every 1 minute. Every minute a new search artifact is created in the $SPLUNK_HOME//var/run/splunk/dispatch directory. These may look at follows:

16 Jun 11:00 scheduler__admin__search__embedtest_at_1466071200_12
16 Jun 11:01 scheduler__admin__search__embedtest_at_1466071260_14

Now the embedded report should look at the latest search artifact "1466071260_14" but instead it is looking at the oldest artifact "1466071200_12".

As per the documentation these search artifact should exist for the time period specific in the dispatch.ttl option in the savesearches.conf file:

http://docs.splunk.com/Documentation/Splunk/6.2.9/Admin/Savedsearchesconf

However, sometimes these search artifacts are not cleared up and old ones can remain. This may explain why some of your reports are showing very old data.

In 6.3.3 it appears the embedded report looks at the newest artifact, not the oldest.

Does this explain your behavior?

Re: Why is an embedded report on a webpage not getting updated to reflect the same report shown in Splunk?

arowsell_splunk — Mon, 20 Jun 2016 08:52:51 GMT

The following bug has been opened:

SPL-122982 - Embedded reports use oldest search artifact

In Splunk 6.4 embedded report is looking at the oldest copy of the related search artifact, rather than the latest. In 6.3 the embedded report looks at the newest artifact.

Re: Why is an embedded report on a webpage not getting updated to reflect the same report shown in Splunk?

jcperrin — Mon, 20 Jun 2016 13:16:57 GMT

Dear Andy
We've followed your explanation, and confirm it explains the "reports not getting updated" issue.
Your proposal for a cron job to workaround the issue will help us, but for your obvious reasons, we'll wait to have the fix before we roll-out our reports in Production.

Could you please update this topic as soon as you have an eta?
Thanks again you very much for your help

Re: Why is an embedded report on a webpage not getting updated to reflect the same report shown in Splunk?

arowsell_splunk — Wed, 22 Jun 2016 11:02:53 GMT

Certainly, I can update this post when the bug is updated.

I'm glad the information helped : )

Re: Why is an embedded report on a webpage not getting updated to reflect the same report shown in Splunk?

arowsell_splunk — Tue, 12 Jul 2016 08:29:20 GMT

The following bug:

SPL-122982 - Embedded report uses oldest search artifact from the history endpoint

Is now reported fixed in Splunk version 6.4.3.

Re: Why is an embedded report on a webpage not getting updated to reflect the same report shown in Splunk?

mortenn_hapro_n — Tue, 09 Aug 2016 08:10:15 GMT

This does sound exactly the same as my report from back in april.. https://answers.splunk.com/answers/390597/embedded-graph-stopped-updating.html

Re: Why is an embedded report on a webpage not getting updated to reflect the same report shown in Splunk?

mortenn_hapro_n — Tue, 09 Aug 2016 08:11:39 GMT

This does appear to be the same issue I reported back in april without getting a response from splunk.. https://answers.splunk.com/answers/390597/embedded-graph-stopped-updating.html

Re: Why is an embedded report on a webpage not getting updated to reflect the same report shown in Splunk?

pCodeMonkey — Thu, 28 Jun 2018 15:46:48 GMT

I am experiencing this issue on version Version 7.1.0 . I wonder if I'm doing something wrong. I just copy pasted the embed code in a static html page; typical embed approach.

Re: Why is an embedded report on a webpage not getting updated to reflect the same report shown in Splunk?

pCodeMonkey — Thu, 28 Jun 2018 15:49:04 GMT

I'm experiencing this issue on Version 7.1.0. Is there something I'm doing wrong? I just copy pasted the embed code in a static html file. The report refreshes fine when on a splunk dashboard.

Re: Why is an embedded report on a webpage not getting updated to reflect the same report shown in Splunk?

arowsell_splunk — Thu, 28 Jun 2018 15:54:03 GMT

Hi, I have just checked and there appears to be a regression of this issue in 7.1.0 which has been addressed in Splunk 7.1.2.

Re: Why is an embedded report on a webpage not getting updated to reflect the same report shown in Splunk?

mjmann88 — Sun, 01 Jul 2018 14:52:05 GMT

I'm also experiencing the same issue on version 7.1.1 - this functionality worked without issue prior to the upgrade for months and just did an upgrade to 7.1.1. I even created brand new reports and embedded the new links, but it only shows the original report that ran and never updates to the destination of the iframe link.

Re: Why is an embedded report on a webpage not getting updated to reflect the same report shown in Splunk?

arowsell_splunk — Sun, 01 Jul 2018 19:03:39 GMT

Hi, yes there appears to be a regression of this issue in 7.1.0 and 7.1.1. It has been fixed in Splunk version 7.1.2.

Re: Why is an embedded report on a webpage not getting updated to reflect the same report shown in Splunk?

mjmann88 — Sun, 01 Jul 2018 19:07:22 GMT

When will version 7.1.2 be available? I will be forced to downgrade versions to the previous version if this can't be done in the next couple of days.

Re: Why is an embedded report on a webpage not getting updated to reflect the same report shown in Splunk?

mortenn_hapro_n — Mon, 02 Jul 2018 07:28:43 GMT

This should not have been posted as an answer, but a comment on the question, fyi..

Re: Why is an embedded report on a webpage not getting updated to reflect the same report shown in Splunk?

arowsell_splunk — Mon, 02 Jul 2018 08:20:03 GMT

Hi, 7.1.2 has an ETA around the 9th July but there is always the possibility this may be pushed back if there are any last minute issues with its QA but I would expect it to be out around that date.

Re: Why is an embedded report on a webpage not getting updated to reflect the same report shown in Splunk?

dd_msearles — Wed, 15 Aug 2018 01:57:03 GMT

I can confirm the fix (re-fix?) in 7.1.2 resolved the issue for me - thanks!!
http://docs.splunk.com/Documentation/Splunk/7.1.2/ReleaseNotes/Fixedissues

2018-06-03
SPL-154567, SPL-154139
embedded report uses oldest search artifact from the history endpoint