Dashboards & Visualizations

Looks as if user is performing a search when logging on to Dashboard with scheduled searches

JYTTEJ
Communicator

All my Dashboards are based on results of scheduled saved searches, so why does it look as if the user is performing a search just by logging on to the Dashboard? - ref below from audit log.

Audit:[timestamp=02-13-2012 12:49:02.848, user=testsearch, action=search, info=granted , search_id='testsearch_testsearch_xxxxxDKXP_UFM2UFNES1hQIFBTX1RJTUUgQ2hlY2tvdXRTdGFydFNlc3Npb24_1329137342.204', search='search = bla bla bla', autojoin='1', buckets=0, ttl=600, max_count=10000, maxtime=0, enable_lookups='1', extra_fields='', apiStartTime='Mon Feb 13 11:49:00 2012', apiEndTime='Mon Feb 13 12:49:02 2012', savedsearch_name="xxxxxxDKXP"][n/a]

Tags (1)
0 Karma

Brian_Osburn
Builder

Is this search saving the results somewhere?

My guess is you are thinking that saved searches == saved results, which isn't necessarily true. The search is still being run in order to get the results back to populate the dashboard.

Brian

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...