Dashboards & Visualizations

How do I use cached report results in dashboards?

chanfoli
Builder

I created some searches with timecharts and added them to a dashboard. Since the searches take some time, I thought I would try to convert them to reports and schedule them (I actually only need them to run once since the data is now historical) so that the dashboards would just load pre-populated reports. I used the "Convert to report" option while editing the panels. I then tried running the reports. It seems that in the dashboard however, the reports are re-run every time the dashboard is loaded. Is what I am trying to do not possible with scheduled reports?

Tags (3)
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Have you tired modifying the time parameters?

For instance, there would be no reason for splunk to generate new query results every time the dash reloads if your latest is set @h or @d.

sarauppal
Explorer

Your answer solved my problem, thanks !

somesoni2
SplunkTrust
SplunkTrust
0 Karma

chanfoli
Builder

The dashboards already use the ref syntax and are accessing the search through referencing the report, but they are re-running the search. It seems from a few comments that I have seen that this is a known issue/expected behavior in a SHC environment. Maybe somebody knows of a workaround.

0 Karma

chanfoli
Builder

Nothing is listed in known issues with 6.5.1 which seems to pertain to this. So I don't know if it is known issue or I have done something wrong.

0 Karma

vasanthmss
Motivator

Hope this will helps you

https://answers.splunk.com/answers/260035/what-can-we-use-to-replace-loadjob-based-dashboard.html

Based on the above link there is an way to load the existing jobs. steps to be followed,

  1. create a search with your base query and let say name it as (my_search), schedule it (required time) wait for the first run.
  2. run the below search | loadjob savedsearch="user:app:my_search" in the search. you can see the exiting search results will be populated with out computing.
  3. Use it in your dashboard

Meaning, you are running the search once (scheduled). splunk will generate the job id (SID) for each job. you are loading the previous successful execution. Other than this, there is no way to catch, like memory cubes / etc.

V

chanfoli
Builder

Looks like the ref solution here still re-runs the search in a SHC environment. My dashboards were created in 6.5.1. and already used the ref syntax after the "convert to report" action was completed. Any way around this? I guess it is a different behavior in a clustered search environment.

0 Karma

chanfoli
Builder

We are running 6.5.1 if this info helps.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...