refreshing the dashboard view of a saved search

[wsw70]

Hello,

I have a dashboard with the graph results of saved searches. The searches are scheduled once per day, which is usually fine but I need from time to time to refresh the results (say, right after new data is added).

• I tried to run the saved search from the Manager (so that there is a new set of results): no impact on the dashboard
• I tried to erase the history of the saved search (in Job Manager): no impact on the dashboard

So either the dashboard keeps a "private copy" of the last scheduled search or it needs itself to be refreshed to take into account the latest version of the search. Or something else?
So how can I refresh the dashboard view?

Thank you.

EDIT: looks like this question was already asked here and there - with no answer. There is no way to do this? (that would be surprising)

[rbw78]

Hello,

Actually, I wonder how to do that too, so i permit myself to post on this topic.

I tried to put on these lines regarding the module HiddenSavedSearch you've previously mentionned Lamar, but nothing happens.

Im not sure about how and where i should put these lines, i did it on my dahsboard xml file file like this :

<dashboard>
      <label>My_dashboard_label</label>
        <module name="HiddenSavedSearch">
        <param name="savedSearch">My_Saved_Search_Name</param>
        <param name="useHistory">False</param>
      </module>

I could set the savedSearch to any value in the parameter mentionned in the splunk doc (Fasle, True, None, ...), nothing is happening.

Could someone confirm how to do it ?

Thanks.

[rbw78]

Thanks for the answer Lamar.

I tried with the following XML code, but when i load the view,i have a 404 error.

Advanced view

I'm almost sure this a syntax issue, because when i replace the module with a sample provided on another module, it works fine.

[Lamar]

The module you're trying to use is an Advanced XML module. Therefore you'll need to write your dashboard in Advanced XML.

The other stuff you've written ( dashboard and label ) is simple XML.

[Lamar · Accepted solution]

Take a look at the "UseHistory" parameter. That may help you answer your question. Play around with it and see what works. It defaults to Auto, which means it looks for a cached version of your search first, if it finds one it uses it. If it doesn't then it will re-queue another search for you.

http://docs.splunk.com/Documentation/Splunk/4.3.3/Developer/ModuleReference#HiddenSavedSearch

I don't think there's really an elegant way to deal with this, but you could just truncate your dispatch directory for this saved search and then refresh your dashboard. Also, keep in mind that if you 'run' your search again from the Manager to have it queue up new results, ensure you've given it enough time to complete.

Hope that helps.

[wsw70]

I removed the directories of the dispatch (which I found at http://splunk-base.splunk.com/answers/44834/changing-path-or-purging-data-from-optsplunkvarrunsplunk... - it also mentioned the possibility to just delete them).
It works exactly as expected (the search are run from scratch) and hopefully when a new saved search is run it will take over (= the results of the saved searches will be used again).
I will try to make sense of the directory names to just remove in the future the ones corresponding to searches I want to see "live").
Thank you for your help!