I'm trying to use the Sideview SavedSearch module to load results from a previous scheduled search in order to quickly populate dropdowns on my page.
<module name="SavedSearch" autoRun="True"> <param name="name">populate_dropdowns</param> <module name="Pulldown"> etc.
My saved search "populate_dropdowns" is running every minute (for testing purposes!).
When I load my dashboard though it always executes the search again though, rather than loading the previously saved results. Looking in the jobs window, I see the following..
I can see the previously scheduled populate_dropdowns job. I can see the populate_dropdowns search being run again when I load the dashboard (but this time I see it's full definition rather than just it's name). Clicking on inspect shows that both instances return exactly the same results.
Thanks for the answer. I'm not using an old version of Sideview (I'm on 2.4.1). However, I think you're right -- the issue is almost certainly what goes before in the dashboard...
Is what I'm trying to do possible?
Many thanks for your help.
<module name="URLLoader" layoutPanel="viewHeader"> <param name="keepURLUpdated">True</param> <module name="TimeRangePicker" layoutPanel="viewHeader"> <param name="searchWhenChanged">True</param> <param name="default">Last 24 hours</param> <param name="label">Time period to report on</param> <module name="SavedSearch" autoRun="True" layoutPanel="viewHeader"> <param name="name"> populate_dropdowns </param>
Note that SavedSearch is a Sideview module packaged with Sideview Utils.
My guess is that you're just using the old 1.3.X version of Sideview Utils from Splunkbase? The module's "useHistory" param was only added in 2.0, which came out in April 2012, only available for download from the Sideview site. New versions of Sideview Utils, with bugfixes, features, new modules, new tools etc, come out about every two weeks and the current version is 2.6.2.
If you're already on a 2.X version, then can you post your dashboard's XML and I'll update my answer. It's also possible that it's the hierarchy in the XML that is actually throwing away the previously dispatched job inadvertently and I'll easily spot where that would be happening.
UPDATE: I see the snippet of the page's XML that you posted, and what's going to happen, from the part posted, is that the TimeRangePicker is going to be completely ignored in that page. If the SavedSearch module is just there to populate the dropdown(s), then you'll want to restructure your view so that the SavedSearch+Pulldown combination(s) are actually upstream from the TimeRangePicker and whatever lies downstream.
As to why it's rerunning the savedsearch without picking up the schedule, I can't tell and I suspect it still has to do with parts of the XML downstream from the snippet you posted. Any chance you can post the whole thing?
Can you post the rest of the XML? My guess is that something downstream is causing a second fork to dispatch. So that you've got the SavedSearch module pumping out the previously dispatched scheduled job, but then a wrinkle or something a little off deeper into the page is causing another dispatch point, and thus the second ad-hoc job.
The way the TimeRangePicker is upstream from the SavedSearch is fine in that it wont trigger a redispatch. However you should know that the TimeRangePicker's argument there is going to be completely ignored - the SavedSearch will clobber it completely.