Can real-time searches be shared between different users viewing the same dashboard?

[laserval]

We have a dashboard that uses a real-time saved search for one panel. The dashboard references the saved search by name. When two users are viewing this dashboard, we get two concurrent real-time search jobs running for the duration of their session.

Can we configure this search so that the results of a single real-time search job is shared for all users of the dashboard, or do we have to change the real-time search to a scheduled search?

[zbumpers]

I am having the same issue, has this been address in the last year? I am running v6.2.

[rturk · Accepted solution]

Hi Laserval,

As far as I'm aware, there is no way around this by re-using a currently running realtime search. I've seen a few suggestions on this site to use the [loadjob][1] command, but from it's description:

Loads events or results of a previously completed search job.

I even tried running a realtime search, (index=_internal), grabbed it's sid and issued the following search in a different browser session:

| loadjob rt_1379339074.324 ignore_running=true

This gave an error saying that there were no artifacts as the search was still running (which makes sense given how realtime searches are performed).

So yep, I think you're going to have to use scheduled searches.

Hope this was of some help 🙂

[laserval]

I suspected as much. Unfortunate, since we've got a whole bunch of these searches on some dashboards.

I guess I'll have to look into setting up more restrictive access to the real-time dashboards.