Dashboards & Visualizations

Can real-time searches be shared between different users viewing the same dashboard?

laserval
Communicator

We have a dashboard that uses a real-time saved search for one panel. The dashboard references the saved search by name. When two users are viewing this dashboard, we get two concurrent real-time search jobs running for the duration of their session.

Can we configure this search so that the results of a single real-time search job is shared for all users of the dashboard, or do we have to change the real-time search to a scheduled search?

0 Karma
1 Solution

rturk
Builder

Hi Laserval,

As far as I'm aware, there is no way around this by re-using a currently running realtime search. I've seen a few suggestions on this site to use the [loadjob][1] command, but from it's description:

Loads events or results of a previously completed search job.

I even tried running a realtime search, (index=_internal), grabbed it's sid and issued the following search in a different browser session:

| loadjob rt_1379339074.324 ignore_running=true

This gave an error saying that there were no artifacts as the search was still running (which makes sense given how realtime searches are performed).

So yep, I think you're going to have to use scheduled searches.

Hope this was of some help 🙂

View solution in original post

zbumpers
New Member

I am having the same issue, has this been address in the last year? I am running v6.2.

0 Karma

rturk
Builder

Hi Laserval,

As far as I'm aware, there is no way around this by re-using a currently running realtime search. I've seen a few suggestions on this site to use the [loadjob][1] command, but from it's description:

Loads events or results of a previously completed search job.

I even tried running a realtime search, (index=_internal), grabbed it's sid and issued the following search in a different browser session:

| loadjob rt_1379339074.324 ignore_running=true

This gave an error saying that there were no artifacts as the search was still running (which makes sense given how realtime searches are performed).

So yep, I think you're going to have to use scheduled searches.

Hope this was of some help 🙂

laserval
Communicator

I suspected as much. Unfortunate, since we've got a whole bunch of these searches on some dashboards.

I guess I'll have to look into setting up more restrictive access to the real-time dashboards.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...