Reporting

Referencing a saved search in simple xml not returning the most recent saved search anymore

simpkins1958
Contributor

We have a simple xml dashboard that has many charts that reference saved searches that are run every night at 3am. Since upgrading to Splunk 7.1.1 when we reference the saved search in our dashboard the search that is used is NOT the most recent saved search it is the oldest. This was not the behavior in Splunk 7.0.x.

savedsearches.conf:

[DatesPrevious30Days]
run_on_startup = true
alert.track = 0
cron_schedule = 0 3 * * *
dispatch.earliest_time = -30d@d
dispatch.latest_time = @d
enableSched = 1
search = index=nmi_main source=netmotion sourcetype=nm_session \
| fields _time \
| stats min(_time) as firstTime max(_time) as lastTime \
| eval totalDays=round((lastTime-firstTime)/86400,0) \
| eval firstTime=strftime(firstTime, "%a %b %e, %Y") \
| eval lastTime=strftime(lastTime, "%a %b %e, %Y")

alt text

alt text

iwks
Explorer

I'm having this problem with SE 7.1.0. Did you ever find a solution?

0 Karma

nadlurinadluri
Communicator

I am not sure on the issue, as we are still using 6.64; but did you happen to use the below for calling the saved search and try it?
|loadjob savedsearch="owner:app:savedsearchname"

0 Karma

iwks
Explorer

I use <search ref="saved_search_name"></search> in Simple XML dashboards, so I'm not sure how I would adapt that to use the | loadjob construct.

0 Karma

nadlurinadluri
Communicator

Before applying this on the dashboard, you can try running this on the search bar, and see if it is taking the latest savedsearch result,

|loadjob savedsearch="owner:app:savedsearchname"

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...