Hi,
a scheduled search is used twice in a dashboard (as table and graph). But one panel is always "waiting for data". Is this expected behaviour?
When I do not schedule the search, everything is fine and both panels show correct results.
Best
Heinz
I agree that both panels should have the same data, from the cached search results. I would carefully check the dashboard xml to make sure that you are calling the same scheduled search. If so, I would open a ticket with Splunk Support.
I'm calling the same search. It seems to me like a display issue:
I can inspect the search of the "waiting for data" panel.
And when I click the refresh button , the results are loaded correctly.
Run the search once but use the results twice like this:
http://docs.splunk.com/Documentation/Splunk/6.2.4/AdvancedDev/PostProcess
Hm, sounds a bit complicated to use, instead of just loading the cached job results again...
It is just a second cache.