Dashboards & Visualizations

Looks as if user is performing a search when logging on to Dashboard with scheduled searches

JYTTEJ
Communicator

All my Dashboards are based on results of scheduled saved searches, so why does it look as if the user is performing a search just by logging on to the Dashboard? - ref below from audit log.

Audit:[timestamp=02-13-2012 12:49:02.848, user=testsearch, action=search, info=granted , search_id='testsearch_testsearch_xxxxxDKXP_UFM2UFNES1hQIFBTX1RJTUUgQ2hlY2tvdXRTdGFydFNlc3Npb24_1329137342.204', search='search = bla bla bla', autojoin='1', buckets=0, ttl=600, max_count=10000, maxtime=0, enable_lookups='1', extra_fields='', apiStartTime='Mon Feb 13 11:49:00 2012', apiEndTime='Mon Feb 13 12:49:02 2012', savedsearch_name="xxxxxxDKXP"][n/a]

Tags (1)
0 Karma

Brian_Osburn
Builder

Is this search saving the results somewhere?

My guess is you are thinking that saved searches == saved results, which isn't necessarily true. The search is still being run in order to get the results back to populate the dashboard.

Brian

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...