Hi. I've created a number of dashboards using Saved Searches, instead of inline queries. Since updating to Splunk 6, these aren't updating when the dashboard is refreshed. The panels with inline queries update normally. Do they need to be scheduled to update?
For example, I have a report which shows Administrator logons for the last 6 hours. I want this to update periodically. They are displayed in Chrome with an extension to rotate through the tabs every 60 seconds and refresh.
Should I just schedule these reports to run every 5 minutes or so? Or change them to inline queries.
Unfortunately, I realised that because we're on Splunk Free I can't schedule reports, so I've had to change them all to inline queries.
Has the old "Saved Search" functionality been removed completely in favour of Reports? It was useful to be able to save common queries that I didn't necessarily want as a report, and access them from the menu drop down.