Hi,
sometimes the scheduled reports fail and the dashboards tell me that no data is available.
Is there an easy way to refresh the cache or to rerun the scheduled search? At the moment I change the schedule options to a cron job starting in 5 min and change it back to "run every day" when the search is finalized.
Heinz
We have a scenario where several dozen scheduled reports fail or the indexer was offline, etc., and they need to be re-ran. If there was a way to re-run the reports en masse either from within the dashboard, or some other method, that would be great! Then users wouldn't have a bad dashboard until the next scheduled run.
How are you loading the results for the dashboard? Using loadjob
, <searchName>...</searchName>
or a <searchString>| savedsearch ... </searchString>
? Or something else?
For savedsearch
, it shouldn't matter if the search is scheduled or not. Viewing the dashboard should trigger a search if there are no cached results.
For loadjob
, it should be enough to run the report manually once.
It happend again last night, this time the dashboard shows obviously wrong results. I checked it via the jobs manager and opend the scheduled search, it shows these wrong results...Starting the search again brings correct results, very strange.
The timerange is "all time". This includes around 60 days atm.
Do you mean checking the results of the last run by opening it via the jobs manager? Unfortunately I've already overwritten the cache with a cron job. If it reappears tomorrow, I'll check it.
Ah, that will create a dashboard panel that uses the <searchName>...</searchName>
syntax in the XML description of your dashboard.
Have you checked what the results of the last run of your report was? It sounds like they sometimes return no results; which is a problem with the report, not the dashboard. What is the time range of the report?
I didn't use something like this...I created the dashboard out of the scheduled report window by using "Add to Dashboard - Panel Powered By: Report"
Are the data for the dashboard stored in a summary index?
if so, you can use the "backfill script" have look at
http://docs.splunk.com/Documentation/Splunk/6.0.1/Knowledge/Managesummaryindexgapsandoverlaps
if not, why?
bye norbert
Hi
no, the data isn't stored in a summary index yet. So it's just about refreshing the cache of a scheduled search.