I have worked around that problem. I wanted to create a dashboard with live data. But you can only do a numbered of real time searches. So I worked around it by doing the search every 10 sec, for the light searches that need live data, and 1 min, for the bigger searches where the live data isn't that critical.
You can convert your dashboard to an HTML page and then use java script to restart your searches. I'll give a example:
var searchID1= new SearchManager({
"id": "searchID1",
"latest_time": "@m",
"earliest_time": "-1m@m",
"search": "index=* ...seach... | rangemap field=value ...rangemap...,
"status_buckets": 0,
"cancelOnUnload": true,
"app": utils.getCurrentApp(),
"auto_cancel": 90,
"preview": true,
"runWhenTimeIsUndefined": false
}, {tokens: true, tokenNamespace: "submitted"});
new SearchEventHandler({
managerid: "searchID1",
event: "preview",
conditions: [
{
attr: "any",
value: "*",
actions: [
{"type": "set", "token": "value1", "value": "$result.value$"},
{"type": "set", "token": "range1", "value": "$result.range$"}
]
}
]
});
var searchID2= new SearchManager({
"id": "searchID1",
"latest_time": "@m",
"earliest_time": "-1m@m",
"search": "index=* ...seach... | rangemap field=value ...rangemap...,
"status_buckets": 0,
"cancelOnUnload": true,
"app": utils.getCurrentApp(),
"auto_cancel": 90,
"preview": true,
"runWhenTimeIsUndefined": false
}, {tokens: true, tokenNamespace: "submitted"});
new SearchEventHandler({
managerid: "searchID2",
event: "preview",
conditions: [
{
attr: "any",
value: "*",
actions: [
{"type": "set", "token": "value2", "value": "$result.value$"},
{"type": "set", "token": "range2", "value": "$result.range$"}
]
}
]
});
This are your searches in javascript. Now they all have a ID so we can call that ID to restart the search:
window.setInterval(function() {
searchID1.startSearch();
}, 5*1000);
window.setInterval(function() {
searchID2.startSearch();
}, 60*1000);
With this you can rerun your searches. The time is in milliseconds.
I hope this helps you to your solution
... View more
