Dashboards & Visualizations

loadjob

auzark
Communicator

Hi,

I have a loadjob command in one of my panel's in a dashboard . The report results I am trying to load is cron scheduled for every 15 minutes.  The Panel is set to refresh every 20 minutes.  

Very often the dashboard does not load any results, generally just saying "Waiting for queued job to start." I have tried adding the artefact offset to pull in past report output and get an error.

What am I doing wrong? 

also is it possible to pull the timestamp relating to report run results, I am trying to pull into my panel as well?

<query>|loadjob savedsearch="user:Report Name"</query>

<query>|loadjob savedsearch="user:Report Name":artifact_offset=2</query>

 Error in 'SearchOperator:loadjob': Cannot find artifacts for savedsearch_ident 'user:Report Name:artifact_offset=1'.

This will be a shared Dashboard, so I'm trying to create the dashboard in a way that each time it is opened it does not put pressure on the system. I would like to have all of my panels do the same.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Data Management Digest – August 2026

MichelleCorpora_1-1788182384472.png Welcome to the August 2026 edition of Data Management Digest! August was a ...

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next.  Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...