Dashboards & Visualizations

Why is my Dashboard not loading results of Scheduled Searches when Moved to a New App?

BenjaminWyatt
Communicator

I have created several saved searches that run once per day (between 1 AM and 2 AM). These searches populate a dashboard. My ultimate goal is to create a new App that will house this dashboard and several others like it, but I have been developing it in the Search app before migrating it to the new app.

Now, when I open the dashboard in the Search app, everything works fine; the dashboard loads the results of the saved searches. When I open the dashboard in the new app I have created, the dashboard runs the searches every time I load it instead of using the results of the previous searches. I've tried keeping the dashboard in the Search App and giving it Global permissions so that my new app can access it - I encounter the same problem.

So, how can I get my dashboard to load the results of the Saved Searches in an app context other than Search?

Tags (1)
0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

[EDIT] adding answer from PeauxDunk as a real answer

Saved searches are app specific. You need to rebuild the search in the new app and save it.

View solution in original post

yannK
Splunk Employee
Splunk Employee

[EDIT] adding answer from PeauxDunk as a real answer

Saved searches are app specific. You need to rebuild the search in the new app and save it.

BenjaminWyatt
Communicator

That did it. Thanks!

0 Karma

peauxdunk
Explorer

Saved searches are app specific. You need to rebuild the search in the new app and save it.

BenjaminWyatt
Communicator

I'm not sure what you mean. The time range on the scheduled search is something like -25h@h to -1h@h; it uses that time range whether it runs once a day (per the schedule I want) or when the dashboard loads.

The saved searches that the dashboard uses live in the search app; I didn't migrate them to the new app, though I did give them global permissions. Perhaps the problem is that the searches live in the Search app, rather than the new one?

I don't think it's an XML issue; the problem only appears when I run it in the new app. It works fine in the search app.

peauxdunk
Explorer

Sounds like this dashboard has a problem with the time range mismatch. Does your search app have a defaulted time range set from earlier searches? It may have persisted in the 'search' app, but never was set in your new one.

I'd assume you've gone through the manager and also checked out the XML running the dash to verify the time range is in fact where you want it?

0 Karma

BenjaminWyatt
Communicator

Correct. Instead of displaying the cached results of the search that ran at the scheduled time (1 - 2 AM), the dashboard re-runs the searches, and displays those results.

0 Karma

peauxdunk
Explorer

So your dash is displaying inline search results instead of cached search results? Just want to understand this correctly before swinging at it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...