For every scheduled search I have that runs in intervals greater than every 24 hours, my dashboards will not use the results of the last run, but instead will run the search inline. I am setting the useHistory
parameter to auto
, such that it will use the results of the last run, or run it inline if it can't find them. The problem is, it can never find them.
I know the TTL you specify in your saved_searches.conf file is the go-to place for configuring this setting. Mine is currently set to 2p
, which as I understand, means the results of each one will be set to two times the length of the interval between each search (e.g. - the results for a scheduled search set to run every MONTH will live on the server for 2 months). Also, I am unclear as to whether this interval also applies to scheduled searches that implement CRON scheduling (instead of the basic start time & end time settings available when you set-up or modify a saved search's settings in the manager UI).
However, I can literally NEVER get these to load by default in my view without the view first having to re-run the search in its entirety.
Before posting, please keep in mind:
(1) Yes, I have the name of the scheduled spelled correctly in my view (otherwise, I'm pretty sure you'd get an error)
(2) I am not trying to run a saved search from the search bar and use 'Actions' > 'Save'. This search runs automatically and I'm trying to incorporate its results into my View and create a graphical representation of them.
Any help / feedback is much appreciated! I've been trying to overcome this issue for a while now.