Are there plans to get autorefresh and hidden post process nested in a hidden saved search module?

[subtrakt]

Are there any plans to get autorefresh module working with hiddenpostprocess module that is nested in a hiddensavedsearch module?

Many larger dashboards run off of hiddensavedsearches and would benifet from "micro" panel updates. In a dashboard of 20 panels, it would be neat to have 4 different autorefresh modules that update the panels separately and prevent that sudden slowdown to a browser as the whole page reloads. Could the hiddenpostprocess have autorefresh? Is there a way to work-around it to get it to work? Perhaps with null modules?

[sideview · Accepted solution]

the best workaround is to use the loadjob command in the Search module, and to avoid the HiddenSavedSearch module and SavedSearch module.

| loadjob savedsearch="admin:search:MySavedSearch" will effectively give back the result rows of the most recently scheduled job of the "MySavedSearch" search, in the "search" app, as owned by the "admin" user.

http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/Loadjob

It's a bit more fussy than just using a nice SavedSearch module, but the one big advantage is that if you run this search 15mins later, you'll get the next set of results from an "every 15mins" scheduled search.

I don't have any plans right now to greatly reimplement the SavedSearch module. And that's where the limitation is by the way - not the PostProcess module or HiddenPostProcess module. Both Splunk's HiddenSavedSearch module and Sideview's SavedSearch module go and get the scheduled search results once when the whole page loads and never again.

If any questions arise about the loadjob workaround let me know. I'm hoping this workaround can keep folks reasonably happy for a while longer.

[sibbsnb]

I get an error on dashboard if the search results are not found and it stops refreshing the panel. How can i make sure i dont get an error and the search is run if it does not exist