Dashboards & Visualizations
Highlighted

How do I use cached report results in dashboards?

Builder

I created some searches with timecharts and added them to a dashboard. Since the searches take some time, I thought I would try to convert them to reports and schedule them (I actually only need them to run once since the data is now historical) so that the dashboards would just load pre-populated reports. I used the "Convert to report" option while editing the panels. I then tried running the reports. It seems that in the dashboard however, the reports are re-run every time the dashboard is loaded. Is what I am trying to do not possible with scheduled reports?

Tags (3)
0 Karma
Highlighted

Re: How do I use cached report results in dashboards?

Builder

We are running 6.5.1 if this info helps.

0 Karma
Highlighted

Re: How do I use cached report results in dashboards?

Motivator

Hope this will helps you

https://answers.splunk.com/answers/260035/what-can-we-use-to-replace-loadjob-based-dashboard.html

Based on the above link there is an way to load the existing jobs. steps to be followed,

  1. create a search with your base query and let say name it as (my_search), schedule it (required time) wait for the first run.
  2. run the below search | loadjob savedsearch="user:app:my_search" in the search. you can see the exiting search results will be populated with out computing.
  3. Use it in your dashboard

Meaning, you are running the search once (scheduled). splunk will generate the job id (SID) for each job. you are loading the previous successful execution. Other than this, there is no way to catch, like memory cubes / etc.

Highlighted

Re: How do I use cached report results in dashboards?

Builder

Looks like the ref solution here still re-runs the search in a SHC environment. My dashboards were created in 6.5.1. and already used the ref syntax after the "convert to report" action was completed. Any way around this? I guess it is a different behavior in a clustered search environment.

0 Karma
Highlighted

Re: How do I use cached report results in dashboards?

SplunkTrust
SplunkTrust
0 Karma
Highlighted

Re: How do I use cached report results in dashboards?

Builder

The dashboards already use the ref syntax and are accessing the search through referencing the report, but they are re-running the search. It seems from a few comments that I have seen that this is a known issue/expected behavior in a SHC environment. Maybe somebody knows of a workaround.

0 Karma
Highlighted

Re: How do I use cached report results in dashboards?

Builder

Nothing is listed in known issues with 6.5.1 which seems to pertain to this. So I don't know if it is known issue or I have done something wrong.

0 Karma
Highlighted

Re: How do I use cached report results in dashboards?

SplunkTrust
SplunkTrust

Have you tired modifying the time parameters?

For instance, there would be no reason for splunk to generate new query results every time the dash reloads if your latest is set @h or @d.

Highlighted

Re: How do I use cached report results in dashboards?

Explorer

Your answer solved my problem, thanks !