Splunk Search

Saved Search ( Scheduled Report) in Simple XML Dashboard

madhav_dholakia
Contributor

Hello,

I am facing an issue when a saved report is used in a simple xml dashboard using 

| loadjob savedsearch="madhav.d@xyz.com:App_Support:All Calls"

 

My time zone preference is (GMT+01:00) Greenwich Mean Time : London and the report I am referring to (All Calls) is also created by me and runs every 15 mins.

Now, when I use this report in a simple xml dashboard, it only provided data as on an hour ago.

Example: when the report runs at 08:00 AM and I check dashboard at 08:05 AM, it will show report results for 07:00 AM run and not the latest.

I expect this to be due to recent day light saving time changes in UK. Can someone please help how should I handle this?

Thank you.

Regards,

Madhav

Labels (1)
0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @madhav_dholakia 

When you run the same loadjob in the SPL search bar at the same time as in the dashboard - do you get the same - old - results?

Does the scheduled search job you're loading have the earliest/latest fixed in the SPL or the search config? What is this set to?

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...