Dashboards & Visualizations

Splunk 6.2.4: Why is our dashboard panel not using a scheduled report as the base search (search artifact)?

New Member

With our Splunk 6.2.4 enterprise install, a pre created scheduled report when used as a base search in a dashboard:
a) is not using scheduled run's result (ie search artifact)
b) instead the search is run on every dashboard launch.

Goal: have the dashboard use results from a scheduled report such as to speed up the launch.
Not a solution: Base search - this runs with every dashboard launch.

Is there any other alternative to use a scheduled report as input to a panel (the panel(s) will do additional searches based on that pre computed data.)


NOTE: loadjobs is broken in 6.2.4 (asof 6.2 for sure SPL-91780). Doesn't look like its fixed in 6.2.4

0 Karma

Esteemed Legend

Check out this answer on how to use global search elements:


Also, you can choose to speed up your base search by using a summary index:


You can even use both of these together.

Another way to do what you are currently trying to do is to use loadjob like this shows (I know; you say it is broken):


Also, there is no reason that you cannot use Dynamic Lookups (store using outputlookup and then read using inputlookup) for this:


0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>