In splunk 6.0, I created two Saved Searches.
I have an user with admin access and another user with user access (I don't know if it really matters in this case).
I created a dashboard with 4 panels, the last 2 are Pivot graphics. The first two panels are reports based on these 2 saved searches I created.
The problem is that when I open the dashboard with the user with "user" level access, one of then is shown as the search is being executed, but the other does not, only the Loadng 0% and the panel is shown. No errors are presented. If I open the same dashboard with the user with admin access, both panels are shown as the search is being executed.
Inspecting the job, BOTH has the isPreviewEnabled=False, and cannot find anywhere to enable it.
I've created a third search to test, similar to the one that has a problem, and nothing changed.
My searches are configured as:
Search-Problem 2013-10-12 00:00:00 BRT flashtimeline user Clients 0 Global
Search-probl-new None None user Clients 0 Global
Search-OK 2013-10-12 00:00:00 BRT None user Clients 0 Global
Please, How can I make all reports preview the results as the seach is being executed ?
Thanks a lot !
My suspicion is that the limit on current searches for the user role (3 by default) causes the job driving one of the panels to be queued. It's not possible to preview a job as long as it's queued.
You could try to increase the limit in Settings -> Access Controls -> Roles.