Dashboards & Visualizations

Can real-time searches be shared between different users viewing the same dashboard?

Communicator

We have a dashboard that uses a real-time saved search for one panel. The dashboard references the saved search by name. When two users are viewing this dashboard, we get two concurrent real-time search jobs running for the duration of their session.

Can we configure this search so that the results of a single real-time search job is shared for all users of the dashboard, or do we have to change the real-time search to a scheduled search?

0 Karma
1 Solution

Builder

Hi Laserval,

As far as I'm aware, there is no way around this by re-using a currently running realtime search. I've seen a few suggestions on this site to use the [loadjob][1] command, but from it's description:

Loads events or results of a previously completed search job.

I even tried running a realtime search, (index=_internal), grabbed it's sid and issued the following search in a different browser session:

| loadjob rt_1379339074.324 ignore_running=true

This gave an error saying that there were no artifacts as the search was still running (which makes sense given how realtime searches are performed).

So yep, I think you're going to have to use scheduled searches.

Hope this was of some help 🙂

View solution in original post

New Member

I am having the same issue, has this been address in the last year? I am running v6.2.

0 Karma

Builder

Hi Laserval,

As far as I'm aware, there is no way around this by re-using a currently running realtime search. I've seen a few suggestions on this site to use the [loadjob][1] command, but from it's description:

Loads events or results of a previously completed search job.

I even tried running a realtime search, (index=_internal), grabbed it's sid and issued the following search in a different browser session:

| loadjob rt_1379339074.324 ignore_running=true

This gave an error saying that there were no artifacts as the search was still running (which makes sense given how realtime searches are performed).

So yep, I think you're going to have to use scheduled searches.

Hope this was of some help 🙂

View solution in original post

Communicator

I suspected as much. Unfortunate, since we've got a whole bunch of these searches on some dashboards.

I guess I'll have to look into setting up more restrictive access to the real-time dashboards.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!