HI,
We are looking to enhance our real time dashboard performance, in away of that we have scheduled real time searches and expecting to load this searches by their triggered time .
Is their a way we can load real time scheduled searches?
Thanks
Not sure if changing it to a scheduled real-time dashboard would really enhance the performance. Real-time searches are very expensive and should be avoided. You could use a regular saved search, executed at frequent interval and load the result of search in your dashboard.
you can get sid using -| rest /services/search/jobs count=0 | search isDone=1 isSavedSearch=1 | table label sid
| loadjob $sid$
normally an sid look like this - search_id='scheduler_nobody_U3BsdW5rX1NBX0NJTQ_RMD5eddd0618b168fff8_at_1457648640_1115'
1457648640 -is the epoch execution time , use a token to be passed to convert your time into epoch and append that to sid.