I created some searches with timecharts and added them to a dashboard. Since the searches take some time, I thought I would try to convert them to reports and schedule them (I actually only need them to run once since the data is now historical) so that the dashboards would just load pre-populated reports. I used the "Convert to report" option while editing the panels. I then tried running the reports. It seems that in the dashboard however, the reports are re-run every time the dashboard is loaded. Is what I am trying to do not possible with scheduled reports?
Hope this will helps you
Based on the above link there is an way to load the existing jobs. steps to be followed,
| loadjob savedsearch="user:app:my_search"in the search. you can see the exiting search results will be populated with out computing.
Meaning, you are running the search once (scheduled). splunk will generate the job id (SID) for each job. you are loading the previous successful execution. Other than this, there is no way to catch, like memory cubes / etc.
Looks like the ref solution here still re-runs the search in a SHC environment. My dashboards were created in 6.5.1. and already used the ref syntax after the "convert to report" action was completed. Any way around this? I guess it is a different behavior in a clustered search environment.
The dashboards already use the ref syntax and are accessing the search through referencing the report, but they are re-running the search. It seems from a few comments that I have seen that this is a known issue/expected behavior in a SHC environment. Maybe somebody knows of a workaround.
Nothing is listed in known issues with 6.5.1 which seems to pertain to this. So I don't know if it is known issue or I have done something wrong.
Have you tired modifying the time parameters?
For instance, there would be no reason for splunk to generate new query results every time the dash reloads if your latest is set @h or @d.