Call saved searches
Dashboards in the Search & Reporting app that use reports transfer as JSON stanzas of type ds.savedSearch
when you open them in Dashboard Studio.
Properties for calling your report or saved search
The following is a table that provides information regarding the ways to call a saved search and the behavior for these searches when the dashboard loads. Depending on how you call your saved search, scheduled and non-scheduled saved searches handle cached results differently.
Data source type | Property | Type | Behavior when the dashboard loads |
---|---|---|---|
ds.savedSearch | ref | Dashboard option | The behavior differs depending on if the search is scheduled or non-scheduled:
|
ds.search | savedsearch | SPL command | Always runs a new search and accepts tokens. This behavior is the same whether the search is scheduled or non-scheduled. |
loadjob | Attempts to load existing latest cached results from a saved search. If it does not find any results to load, an error displays: This behavior is the same whether the search is scheduled or non-scheduled. |
For more details about savedsearch
and loadjob
, see savedsearchsavedsearch and loadjobloadjob in the Search Reference manual.
Reference a saved search using ds.savedSearch
You can use the ref
dashboard option to call a report or saved search. When using the ref
property, you must reference a saved search or report by its exact name. Additionally, you must use the app
property to specify which app the saved search or report belongs to. If no app is specified, the Splunk platform assumes the report came from the app in which the dashboard resides.
Change the data source's name
Before setting the ref
property, you might want to change the data source's name to a name that's easily identifiable in the dashboard definition.
- Select the visualization that you want to use with the saved search or report. Selected visualizations highlight with a blue border.
- Navigate to the Data sources section of the Configuration panel.
- Select the edit icon next to the data source's name.
- Change the Data source name to something easily identifiable, such as
reportNoScheduleNoRefresh
. - Select Apply and close.
Add the ref property to the dashboard definition
The following steps are an example of using the ref dashboard option to call a report or saved search:
- Open the Source code editor of your dashboard.
- Navigate to the
dataSources
stanza of the dashboard definition. - Identify which data source you want to change to a saved search or report.
- Replace the data type from
ds.search
tods.savedSearch
. - Add the
ref
property to theoptions
stanza and include the exact name of your saved search or report. - Add the
app
property to theoptions
stanza and include the name of the app the saved search or report belongs to. - Select Apply and close.
This example shows a data source type set to ds.savedSearch
.
"reportNoScheduleNoRefresh": {
"type": "ds.savedSearch",
"options": {
"ref": "Top 100 sourcetypes in the last 24 hours",
"app": "search"
}
},
About the app property
The default assumption is that the saved search you're using lives in the app you're working in. If you created your saved search within any app other than Dashboard Studio, you must use the app
option and set it to the app where you originally saved the saved search. For example, if you created a saved search in an app called "my-app", the stanza would look like the following:
"reportNoScheduleNoRefresh": {
"type": "ds.savedSearch",
"options": {
"ref": "Top 100 sourcetypes in the last 24 hours",
"app": "my-app"
}
},
Access reports and saved searches
To call a saved search or report, you need the exact name of the report you want to use and the app name of the original saved search or report. You can find details about your saved searches and reports from Searches, reports, and alerts or in the Reports tab.
Browse saved searches from the dashboard
Follow these steps to access saved searches from your dashboard:
- You can browse saved searches from your dashboard in the following ways:
- Navigate to the dashboard toolbar and select the Data source overview icon (
).
- Select your visualization. Selected visualizations highlight with a blue outline. Navigate to the Configuration panel and into the Data sources section. Select + Set up primary data source. The Select data source panel opens.
- Navigate to the dashboard toolbar and select the Data source overview icon (
- Navigate to the Saved search section.
- Select + Create saved search. The Select a saved search panel opens.
- Find and select your saved search by choosing an app from the App dropdown list, filtering by Owner or searching by the exact name of the saved search.
- After choosing a saved search, you can view details about the search by selecting Open in reports.
- If any new saved searches are created while your dashboard is open, that particular saved search will not appear as an option until the dashboard refreshes.
- Specify the time range for the saved search:
Inherit the time range from the saved search
- Any time range input on the page
- A static time range. For example, the last 7 days, regardless of other input selections.
- Select Apply and close.
Browse from Searches, reports, and alerts or in the Reports tab
The following steps show how to access a saved search or report from Searches, reports, and alerts or in the Reports tab:
- Navigate to your preferred section.
- Select the Settings dropdown list and choose Searches, reports, and alerts.
- Select the Reports tab for a table of all saved searches and reports. In Reports, saved searches are called reports.
- (Optional) Filter for your report in the filter bar.
- Find the details of your saved search or report.
- In Searches, reports, and alerts, the column names of the table show the details about the saved search or report.
- In Reports, select the chevron icon next to your report for details about the report.
- Make a note of the details needed for calling a saved search or report. You will need the following:
- The exact name of the report you want to use.
- The app name of the original saved search.
For more details about reports, see Create and edit reportsCreate and edit reports in the Reporting Manual.
Add reports and saved searches from the Reports tab
Follow these steps to add a report or saved search to your dashboard directly from the Reports tab.
- Navigate to the Reports tab. In Reports, saved searches are called reports.
- Select your report to open it in its individual page.
- Select the Add to Dashboard drop-down list in the top toolbar.
- Select either Existing Dashboard or New Dashboard.
- Existing Dashboard lists existing Dashboard Studio and Classic Simple XML dashboards.
- New Dashboards provides a modal to create a new Dashboard Studio or Classic Simple XML dashboard.
- Follow the UI instructions for choosing an existing dashboard or creating a new dashboard.
- Verify the selections in Advanced Panel Settings. The default setting for Panel Powered By is Report. Keeping the default setting to Report retains the report's metadata, such as schedule, acceleration, and permissions.
- (Optional) Select Inline Search to copy the report's search and time range. The inline search detaches from the report's setting constraints, exists only in the dashboard, and has no external dependencies. For example, if a user changes the original report, those changes don't pass on to the inline search because the inline search exists independently from the report.
- Select Save to Dashboard.
For more details about reports, see Create and edit reportsCreate and edit reports in the Reporting Manual.
Call a report or saved search using ds.search
You can use savedsearch
or loadjob
to call a saved search or report. Each Search Processing Language (SPL) command has different capabilities. For example, savedsearch
can accept tokens.
The following steps are an example of using the SPL command savedsearch
or loadjob
to gather data for a visualization.
- Select your visualization. Selected visualizations highlight with a blue border.
- Select + Set up primary data source in the Data sources section of the Configuration panel.
- Create a new search or select a saved search.
- To create a new search, select + Create search.
- In the SPL query text box, add your search.
- A search using
savedsearch
might look like the following:| savedsearch <your saved search's name>
. - A search using
loadjob
might look like the following:| loadjob savedsearch="admin:<your app's name>:<your saved search's name>"
- A search using
- Select Apply and close.
For more details about savedsearch
and loadjob
, see savedsearchsavedsearch and loadjobloadjob in the Search Reference manual.
Scheduled saved searches
When editing a data source in the source code, if you reference a scheduled saved search, your dashboard works with that schedule regardless of whether you set the refresh
or refreshType
options. For example, if a report from the Search & Reporting app is scheduled to run at the top of every minute, setting the refresh interval to 5 seconds in the JSON stanza has no effect. The scheduled search continues to run at the top of every minute. The same is true for any settings that apply to the data source type in the defaults
section of the dashboard definition.
ds.savedSearch options
Unlike ds.search
, the ds.savedSearch
data source type does not work with the name
or query
options. The only options you can use are ref
and app
, as well as refresh
and refreshType
for non-scheduled searches. For example, the following saved search refreshes in 5 second intervals:
"reportNoScheduleWithRefresh": {
"type": "ds.savedSearch",
"options": {
"ref": "Current Time",
"refresh": "5s",
"refreshType": "interval"
},
Concurrency limits
If you have multiple saved searches in your dashboard, your dashboard only runs as many searches as your concurrency limit. Your limits.conf
file lists concurrency limits for different search types. For example, if your concurrency limit is 3 and you have 5 saved searches, the first 3 saved searches in the queue run, but the last 2 don't. Concurrency limits prevent scheduled searches from queuing indefinitely.
For dashboards with more saved searches than the concurrency limit, use an ad hoc or inline search with the savedsearch
command to call the saved search. An ad hoc or inline search creates a scenario where searches that exceed the concurrency limit still queue and run when capacity allows.
To learn about inline searches, see Inline searchesInline searches in the Dashboards and Visualizations with SXML manual.
For a list of settings for search concurrency limits, see Concurrency in the Admin Manual.