How to load scheduled real time search using their search id or search name?

[splunker9999]

HI,

We are looking to enhance our real time dashboard performance, in away of that we have scheduled real time searches and expecting to load this searches by their triggered time .

Is their a way we can load real time scheduled searches?

Thanks

[somesoni2]

Not sure if changing it to a scheduled real-time dashboard would really enhance the performance. Real-time searches are very expensive and should be avoided. You could use a regular saved search, executed at frequent interval and load the result of search in your dashboard.

[jensonthottian]

you can get sid using -| rest /services/search/jobs count=0 | search isDone=1 isSavedSearch=1 | table label sid

| loadjob $sid$

normally an sid look like this - search_id='scheduler_nobody_U3BsdW5rX1NBX0NJTQ_RMD5eddd0618b168fff8_at_1457648640_1115'

1457648640 -is the epoch execution time , use a token to be passed to convert your time into epoch and append that to sid.