Dashboards & Visualizations

Can real-time searches be shared between different users viewing the same dashboard?

laserval
Communicator

We have a dashboard that uses a real-time saved search for one panel. The dashboard references the saved search by name. When two users are viewing this dashboard, we get two concurrent real-time search jobs running for the duration of their session.

Can we configure this search so that the results of a single real-time search job is shared for all users of the dashboard, or do we have to change the real-time search to a scheduled search?

0 Karma
1 Solution

rturk
Builder

Hi Laserval,

As far as I'm aware, there is no way around this by re-using a currently running realtime search. I've seen a few suggestions on this site to use the [loadjob][1] command, but from it's description:

Loads events or results of a previously completed search job.

I even tried running a realtime search, (index=_internal), grabbed it's sid and issued the following search in a different browser session:

| loadjob rt_1379339074.324 ignore_running=true

This gave an error saying that there were no artifacts as the search was still running (which makes sense given how realtime searches are performed).

So yep, I think you're going to have to use scheduled searches.

Hope this was of some help 🙂

View solution in original post

zbumpers
New Member

I am having the same issue, has this been address in the last year? I am running v6.2.

0 Karma

rturk
Builder

Hi Laserval,

As far as I'm aware, there is no way around this by re-using a currently running realtime search. I've seen a few suggestions on this site to use the [loadjob][1] command, but from it's description:

Loads events or results of a previously completed search job.

I even tried running a realtime search, (index=_internal), grabbed it's sid and issued the following search in a different browser session:

| loadjob rt_1379339074.324 ignore_running=true

This gave an error saying that there were no artifacts as the search was still running (which makes sense given how realtime searches are performed).

So yep, I think you're going to have to use scheduled searches.

Hope this was of some help 🙂

View solution in original post

laserval
Communicator

I suspected as much. Unfortunate, since we've got a whole bunch of these searches on some dashboards.

I guess I'll have to look into setting up more restrictive access to the real-time dashboards.

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!