We have a dashboard that uses a real-time saved search for one panel. The dashboard references the saved search by name. When two users are viewing this dashboard, we get two concurrent real-time search jobs running for the duration of their session.
Can we configure this search so that the results of a single real-time search job is shared for all users of the dashboard, or do we have to change the real-time search to a scheduled search?
Hi Laserval,
As far as I'm aware, there is no way around this by re-using a currently running realtime search. I've seen a few suggestions on this site to use the [loadjob][1] command, but from it's description:
Loads events or results of a previously completed search job.
I even tried running a realtime search, (index=_internal
), grabbed it's sid
and issued the following search in a different browser session:
| loadjob rt_1379339074.324 ignore_running=true
This gave an error saying that there were no artifacts as the search was still running (which makes sense given how realtime searches are performed).
So yep, I think you're going to have to use scheduled searches.
Hope this was of some help 🙂
I am having the same issue, has this been address in the last year? I am running v6.2.
Hi Laserval,
As far as I'm aware, there is no way around this by re-using a currently running realtime search. I've seen a few suggestions on this site to use the [loadjob][1] command, but from it's description:
Loads events or results of a previously completed search job.
I even tried running a realtime search, (index=_internal
), grabbed it's sid
and issued the following search in a different browser session:
| loadjob rt_1379339074.324 ignore_running=true
This gave an error saying that there were no artifacts as the search was still running (which makes sense given how realtime searches are performed).
So yep, I think you're going to have to use scheduled searches.
Hope this was of some help 🙂
I suspected as much. Unfortunate, since we've got a whole bunch of these searches on some dashboards.
I guess I'll have to look into setting up more restrictive access to the real-time dashboards.