Dashboards & Visualizations

Can real-time searches be shared between different users viewing the same dashboard?

laserval
Communicator

We have a dashboard that uses a real-time saved search for one panel. The dashboard references the saved search by name. When two users are viewing this dashboard, we get two concurrent real-time search jobs running for the duration of their session.

Can we configure this search so that the results of a single real-time search job is shared for all users of the dashboard, or do we have to change the real-time search to a scheduled search?

0 Karma
1 Solution

rturk
Builder

Hi Laserval,

As far as I'm aware, there is no way around this by re-using a currently running realtime search. I've seen a few suggestions on this site to use the [loadjob][1] command, but from it's description:

Loads events or results of a previously completed search job.

I even tried running a realtime search, (index=_internal), grabbed it's sid and issued the following search in a different browser session:

| loadjob rt_1379339074.324 ignore_running=true

This gave an error saying that there were no artifacts as the search was still running (which makes sense given how realtime searches are performed).

So yep, I think you're going to have to use scheduled searches.

Hope this was of some help 🙂

View solution in original post

zbumpers
New Member

I am having the same issue, has this been address in the last year? I am running v6.2.

0 Karma

rturk
Builder

Hi Laserval,

As far as I'm aware, there is no way around this by re-using a currently running realtime search. I've seen a few suggestions on this site to use the [loadjob][1] command, but from it's description:

Loads events or results of a previously completed search job.

I even tried running a realtime search, (index=_internal), grabbed it's sid and issued the following search in a different browser session:

| loadjob rt_1379339074.324 ignore_running=true

This gave an error saying that there were no artifacts as the search was still running (which makes sense given how realtime searches are performed).

So yep, I think you're going to have to use scheduled searches.

Hope this was of some help 🙂

laserval
Communicator

I suspected as much. Unfortunate, since we've got a whole bunch of these searches on some dashboards.

I guess I'll have to look into setting up more restrictive access to the real-time dashboards.

Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...