Can I save the result of a search sent to background as a dashboard panel ?

[christopheryu]

Sorry if this is a duplicate question...so, I have an email with the link to the completed results from a search that was sent to the background. Obviously, when I click on the link it shows the completed result. How do I save the completed result as a dashboard panel? I tried saving it as a report but when I open the report the search runs again instead of showing the completed result. What am I doing wrong?

Thank you in advance!

[gcusello · Accepted solution]

hi christopheryu,

You can run your search again and then save it in a dashboard panel.

Only one question: you probably sent your search in the background because it's a very slow search, so how can you put it in a dashboard panel?

It would probably be more efficient to schedule your search in a report and then embed this report in your dashboard.

Bye.
Giuseppe

[christopheryu]

thank you for your response cusello. yes, the search takes around 4 hours to finish that is why I sent it to background and setup it up to email me. I then saved the result as a report but when I pull it up from the reports list, it does not show the completed result but rather runs the search again. Ultimately what I am trying to do is save the report with completed result as a dashboard panel so it does not run the search all over again when the dashboard gets pulled up.

[gcusello]

you have to schedule your report (e.g. by night) and embed it in your dashboard.
So for all the following 24 hours you can quickly access report results in your dashboard.

Bye.
Giuseppe

[christopheryu]

Okay. How about the existing result that I have now from the background search that I did? This search is for the past three months (Aug to Oct). Can't I embed the link to the result I have now as a panel on the dashboard?

[gcusello]

Using a scheduled report embedded in dashboard you can quickly access results but you cannot change search parameters.
To embed a report you have to click in right top of the report "Save AS" and choose Dashboard Panel.

If instead you want also change search parameters you have to accelerate your search, see http://docs.splunk.com/Documentation/Splunk/7.2.0/Report/Acceleratereports

Bye.
Giuseppe