Dashboards & Visualizations

Refresh cache/rerun reports for dashboard

HeinzWaescher
Motivator

Hi,

sometimes the scheduled reports fail and the dashboards tell me that no data is available.
Is there an easy way to refresh the cache or to rerun the scheduled search? At the moment I change the schedule options to a cron job starting in 5 min and change it back to "run every day" when the search is finalized.

Heinz

Tags (3)

efavreau
Motivator

We have a scenario where several dozen scheduled reports fail or the indexer was offline, etc., and they need to be re-ran. If there was a way to re-run the reports en masse either from within the dashboard, or some other method, that would be great! Then users wouldn't have a bad dashboard until the next scheduled run.

###

If this reply helps you, an upvote would be appreciated.
0 Karma

laserval
Communicator

How are you loading the results for the dashboard? Using loadjob, <searchName>...</searchName> or a <searchString>| savedsearch ... </searchString>? Or something else?

For savedsearch, it shouldn't matter if the search is scheduled or not. Viewing the dashboard should trigger a search if there are no cached results.

For loadjob, it should be enough to run the report manually once.

0 Karma

HeinzWaescher
Motivator

It happend again last night, this time the dashboard shows obviously wrong results. I checked it via the jobs manager and opend the scheduled search, it shows these wrong results...Starting the search again brings correct results, very strange.

0 Karma

HeinzWaescher
Motivator

The timerange is "all time". This includes around 60 days atm.

Do you mean checking the results of the last run by opening it via the jobs manager? Unfortunately I've already overwritten the cache with a cron job. If it reappears tomorrow, I'll check it.

0 Karma

laserval
Communicator

Ah, that will create a dashboard panel that uses the <searchName>...</searchName> syntax in the XML description of your dashboard.

Have you checked what the results of the last run of your report was? It sounds like they sometimes return no results; which is a problem with the report, not the dashboard. What is the time range of the report?

0 Karma

HeinzWaescher
Motivator

I didn't use something like this...I created the dashboard out of the scheduled report window by using "Add to Dashboard - Panel Powered By: Report"

0 Karma

nekb1958
Path Finder

Are the data for the dashboard stored in a summary index?
if so, you can use the "backfill script" have look at

http://docs.splunk.com/Documentation/Splunk/6.0.1/Knowledge/Managesummaryindexgapsandoverlaps

if not, why?

bye norbert

0 Karma

HeinzWaescher
Motivator

Hi
no, the data isn't stored in a summary index yet. So it's just about refreshing the cache of a scheduled search.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...