Solved: Using saved search results on a dashboard not work... - Page 2

jstockamp · ‎06-14-2011

I've got a saved search configured on a schedule and if I click on "view recent" I can see recent runs and if I click on a run I can see the report output. Now when I try to add this saved search to a dashboard, it's still trying running the search as if there were no saved results available. Where should I start troubleshooting?

ben_leung · ‎03-13-2015

Also facing this issue. Currently on Splunk version 6.0.5

Some panels are pulling the search results of scheduled searches, while some are not.
From the configs below, the panel for Dashboard1 is acting as if it is an inline search.
Dashboard2 panel is working as expected.

<dashboard> 
<label>Testing Dashboard</label>
<description/>
<row>
<chart>
<title>Dashboard1</title>
<searchName>dashboard_search1</searchName>
<option name="charting.chart.showLabels">false</option>
<option name="height">100px</option>
<drilldown target="_blank">
<link>
<![CDATA[/app/search/dashboard1]]>
</link>
</drilldown>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.chart">pie</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="charting.fieldColors">{"NOT Reporting": 0xFF0000, "Reporting": 0x84E900}</option>
</chart>

<chart>
<title>Dashboard2</title>
<searchName>dashboard_search2</searchName>
<option name="charting.chart.showLabels">false</option>
<option name="height">100px</option>
<drilldown target="_blank">
<link>
<![CDATA[/app/search/dashboard2]]>
</link>
</drilldown>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.chart">pie</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="charting.fieldColors">{"NOT Reporting": 0xFF0000, "Reporting": 0x84E900}</option>
</chart>
</row>
</dashboard>

The saved searches dot conf of the search is below.

[dashboard_search1]
action.email.inline = 1
action.email.sendresults = 1
action.email.to = my_email@domain.com
alert.digest_mode = True
alert.expires = 2h
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
counttype = number of events
cron_schedule = 1 * * * *
dispatch.earliest_time = -48h
dispatch.latest_time = now
display.general.timeRangePicker.show = 0
display.general.type = visualizations
display.visualizations.charting.chart = pie
enableSched = 1
quantity = 0
relation = greater than
request.ui_dispatch_view = search
search = index=_internal sourcetype=splunkd | chart max(field_a) as "NOT Reporting" max(field_b) as "Reporting"

[dashboard_search2]
action.email.inline = 1
alert.digest_mode = True
alert.expires = 2h
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
cron_schedule = 0 * * * *
dispatch.earliest_time = -48h@h
dispatch.latest_time = now
display.general.type = visualizations
display.visualizations.charting.chart = pie
enableSched = 1
search = index=_internal sourcetype=splunkd | chart max(field_x) as "NOT Reporting" max(field_y) as "Reporting"

View solution in original post

Using saved search results on a dashboard not working

Announcing Scheduled Export GA for Dashboard Studio

Extending Observability Content to Splunk Cloud

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!