Dashboards & Visualizations

loadjob

auzark
Communicator

Hi,

I have a loadjob command in one of my panel's in a dashboard . The report results I am trying to load is cron scheduled for every 15 minutes.  The Panel is set to refresh every 20 minutes.  

Very often the dashboard does not load any results, generally just saying "Waiting for queued job to start." I have tried adding the artefact offset to pull in past report output and get an error.

What am I doing wrong? 

also is it possible to pull the timestamp relating to report run results, I am trying to pull into my panel as well?

<query>|loadjob savedsearch="user:Report Name"</query>

<query>|loadjob savedsearch="user:Report Name":artifact_offset=2</query>

 Error in 'SearchOperator:loadjob': Cannot find artifacts for savedsearch_ident 'user:Report Name:artifact_offset=1'.

This will be a shared Dashboard, so I'm trying to create the dashboard in a way that each time it is opened it does not put pressure on the system. I would like to have all of my panels do the same.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Data Outage Monitoring and Reporting

We’ve all been there, right? Living our best life, working on our Splunk environment, when out of nowhere a ...

Manage Datasets and Connections in Catalog on Splunk Cloud Platform

Set Up Data Where You Use It Catalog already helps teams find and understand data across Splunk indexes, ...

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...