Can you change permissions on an executed savedsearch?
I have a dashboard that loadjobs a scheduled savedsearch. I needed to grant dashboard access to a new role, so I added permissions for that role both to the dashboard and to the savedsearch. But I got...
View ArticleLoading base query by token
I'm trying to create a dashboard that does not execute the same queries multiple times. From what I have been able to find out online the way to do that is to set a token on your query so it can be...
View ArticleNon-admin user needs savedsearch job date in dashboard
I have non Admin users with dashboards. The base search uses a loadjob of a job that is scheduled each day to look at a day's worth of events. Other searches in the dashboard use the loadjob command....
View ArticleWhy does "Search is waiting for input" has a delay if using loadjob and JS?
Main search: `makeresults | append [| loadjob "$exchange$"] | eval trigger="$submit_trigger1$"` where the ad-hoc loadjob sets `$exchange$` via $job.sid$ However, the "search is waiting for input"...
View ArticleHow to add the trigger time to loadjob?
Hello, I am trying to pull out the last 24 hours worth of results for an alert using ```loadjob```, with the following search: index=_audit splunk_server="splunk-csh" action=alert_fired...
View ArticleIs loadjob compatible with a javascript submit button when used as a base...
I use JS submit buttons because the SimpleXML submit button is useless (searchWhenChanged is broken, you can only have one button, cannot inline, cannot have multiple, and cannot have multiple...
View ArticleHow to pass base search results to subsearch
Hi Folks, We receive several hundred files per day from 20 different sources. The filenames contain the source that we received the file from, and have a three digit sequence number as a suffix....
View Article