SavedSearch module doesn't use results from scheduled search

[MatMeredith]

I'm trying to use the Sideview SavedSearch module to load results from a previous scheduled search in order to quickly populate dropdowns on my page.

        <module name="SavedSearch" autoRun="True">                
            <param name="name">populate_dropdowns</param>
            <module name="Pulldown">
etc.

My saved search "populate_dropdowns" is running every minute (for testing purposes!).

When I load my dashboard though it always executes the search again though, rather than loading the previously saved results. Looking in the jobs window, I see the following..

I can see the previously scheduled populate_dropdowns job. I can see the populate_dropdowns search being run again when I load the dashboard (but this time I see it's full definition rather than just it's name). Clicking on inspect shows that both instances return exactly the same results.

Any ideas?

[MatMeredith]

Thanks for the answer. I'm not using an old version of Sideview (I'm on 2.4.1). However, I think you're right -- the issue is almost certainly what goes before in the dashboard...

• See below. I suspect the issue is the fact that I have a URL loader (with updating enabled) and a Time range picker.
• If this isn't going to work, can you tell me how I can achieve what I need please?
• - I need a timerange picker that allows the user to specify what time range the searches in the page should be run over. This should affect all searches except for those used to populate the dropdowns (which always just run over the last week)
• - I need the URL Loader, and furthermore the page must support both the timerange picker, and the dropdowns that are populated using the saved search, picking up default values from the URL.

Is what I'm trying to do possible?

Many thanks for your help.

---

<module name="URLLoader" layoutPanel="viewHeader">
    <param name="keepURLUpdated">True</param>

    <module name="TimeRangePicker" layoutPanel="viewHeader">
        <param name="searchWhenChanged">True</param>
        <param name="default">Last 24 hours</param>
        <param name="label">Time period to report on</param>                                                        

        <module name="SavedSearch" autoRun="True" layoutPanel="viewHeader">

            <param name="name">
                populate_dropdowns
            </param>

[sideview]

Note that SavedSearch is a Sideview module packaged with Sideview Utils.

My guess is that you're just using the old 1.3.X version of Sideview Utils from Splunkbase? The module's "useHistory" param was only added in 2.0, which came out in April 2012, only available for download from the Sideview site. New versions of Sideview Utils, with bugfixes, features, new modules, new tools etc, come out about every two weeks and the current version is 2.6.2.

http://sideviewapps.com/apps/sideview-utils

If you're already on a 2.X version, then can you post your dashboard's XML and I'll update my answer. It's also possible that it's the hierarchy in the XML that is actually throwing away the previously dispatched job inadvertently and I'll easily spot where that would be happening.

UPDATE: I see the snippet of the page's XML that you posted, and what's going to happen, from the part posted, is that the TimeRangePicker is going to be completely ignored in that page. If the SavedSearch module is just there to populate the dropdown(s), then you'll want to restructure your view so that the SavedSearch+Pulldown combination(s) are actually upstream from the TimeRangePicker and whatever lies downstream.

As to why it's rerunning the savedsearch without picking up the schedule, I can't tell and I suspect it still has to do with parts of the XML downstream from the snippet you posted. Any chance you can post the whole thing?

[sideview]

Can you post the rest of the XML? My guess is that something downstream is causing a second fork to dispatch. So that you've got the SavedSearch module pumping out the previously dispatched scheduled job, but then a wrinkle or something a little off deeper into the page is causing another dispatch point, and thus the second ad-hoc job.

The way the TimeRangePicker is upstream from the SavedSearch is fine in that it wont trigger a redispatch. However you should know that the TimeRangePicker's argument there is going to be completely ignored - the SavedSearch will clobber it completely.

[sideview]

Thanks. I updated my answer. see above.

[MatMeredith]

Hi thanks for this. Did you see the additional info I added below? Any help still appreciated.