I have a dashboard with close to 20 panels. (Each search is taking anywhere between 1 to 5 min to run) The dashboard doesn't have any form elements. For all the panels, the time range is one of the following
- Earliest: -7d@d Latest: @d
- Earliest: -2d@d Latest: @d
I would like the dashboard to run only once every day at 00:00, and every time someone opens the dashboard display the cached results.
**Is it possible to do this by changing a single setting or something like that?**
I couldn't find any option like that. So, I have converted each of the panels to a report and enabled scheduling on each of the reports to run once everyday at 00:00. (<u>with no email or alert actions</u>)<u>(I have configured the scheduling today itself. It is possible that the scheduled search never happened till now. I'm not sure of the timezone of the Splunk server)</u>
Half of the panels are displaying the following error.
In handler savedsearch: Search not executed: The maximum number of historical concurrent system-wide searches has been reached. current= 15 maximum= 15 Searchld=
Earlier, when the dashboard was made using inline searches, 15 of the panels would keep loading and the status for the remaining used to be Queued. Eventually, all the panels used to load without any errors. **Why is the dashboard with embedded reports not behaving in the same way?**
**Will I encounter the same problem when all the 20 scheduled searches get dispatched at 00:00?**
Also, the panels are executing the searches every time. **They don't seem to be using cached results.** I am sure about this as the load time of the results is in minutes. Why is this so?
Splunk version: version=6.2.6
↧