Dashboards & Visualizations

Looks as if user is performing a search when logging on to Dashboard with scheduled searches

JYTTEJ
Communicator

All my Dashboards are based on results of scheduled saved searches, so why does it look as if the user is performing a search just by logging on to the Dashboard? - ref below from audit log.

Audit:[timestamp=02-13-2012 12:49:02.848, user=testsearch, action=search, info=granted , search_id='testsearch_testsearch_xxxxxDKXP_UFM2UFNES1hQIFBTX1RJTUUgQ2hlY2tvdXRTdGFydFNlc3Npb24_1329137342.204', search='search = bla bla bla', autojoin='1', buckets=0, ttl=600, max_count=10000, maxtime=0, enable_lookups='1', extra_fields='', apiStartTime='Mon Feb 13 11:49:00 2012', apiEndTime='Mon Feb 13 12:49:02 2012', savedsearch_name="xxxxxxDKXP"][n/a]

Tags (1)
0 Karma

Brian_Osburn
Builder

Is this search saving the results somewhere?

My guess is you are thinking that saved searches == saved results, which isn't necessarily true. The search is still being run in order to get the results back to populate the dashboard.

Brian

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...