With our Splunk 6.2.4 enterprise install, a pre created scheduled report when used as a base search in a dashboard:
a) is not using scheduled run's result (ie search artifact)
b) instead the search is run on every dashboard launch.
Goal: have the dashboard use results from a scheduled report such as to speed up the launch.
Not a solution: Base search - this runs with every dashboard launch.
Is there any other alternative to use a scheduled report as input to a panel (the panel(s) will do additional searches based on that pre computed data.)
Thanks!
NOTE: loadjobs is broken in 6.2.4 (asof 6.2 for sure SPL-91780). Doesn't look like its fixed in 6.2.4
Check out this answer on how to use global search elements
:
https://answers.splunk.com/answers/231429/can-i-have-multiple-panels-using-the-same-inline-s.html
Also, you can choose to speed up your base search by using a summary index
:
http://docs.splunk.com/Documentation/Splunk/6.3.0/Knowledge/Usesummaryindexing
You can even use both of these together.
Another way to do what you are currently trying to do is to use loadjob
like this shows (I know; you say it is broken):
https://answers.splunk.com/answers/311804/reuse-results-of-a-search.html
Also, there is no reason that you cannot use Dynamic Lookups
(store using outputlookup
and then read using inputlookup
) for this: