Dashboards & Visualizations

Splunk 6.2.4: Why is our dashboard panel not using a scheduled report as the base search (search artifact)?

vputty
New Member

With our Splunk 6.2.4 enterprise install, a pre created scheduled report when used as a base search in a dashboard:
a) is not using scheduled run's result (ie search artifact)
b) instead the search is run on every dashboard launch.

Goal: have the dashboard use results from a scheduled report such as to speed up the launch.
Not a solution: Base search - this runs with every dashboard launch.

Is there any other alternative to use a scheduled report as input to a panel (the panel(s) will do additional searches based on that pre computed data.)

Thanks!

NOTE: loadjobs is broken in 6.2.4 (asof 6.2 for sure SPL-91780). Doesn't look like its fixed in 6.2.4

0 Karma

woodcock
Esteemed Legend

Check out this answer on how to use global search elements:

https://answers.splunk.com/answers/231429/can-i-have-multiple-panels-using-the-same-inline-s.html

Also, you can choose to speed up your base search by using a summary index:

http://docs.splunk.com/Documentation/Splunk/6.3.0/Knowledge/Usesummaryindexing

You can even use both of these together.

Another way to do what you are currently trying to do is to use loadjob like this shows (I know; you say it is broken):

https://answers.splunk.com/answers/311804/reuse-results-of-a-search.html

Also, there is no reason that you cannot use Dynamic Lookups (store using outputlookup and then read using inputlookup) for this:

https://wiki.splunk.com/Dynamically_Editing_Lookup_Tables

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>