topic drilldown best practices in Dashboards & Visualizations

drilldown best practices

jip31 — Thu, 22 Oct 2020 04:33:31 GMT

Hello

I used a scheduled search in a table panel of my dashbaord

| loadjob savedsearch="admin:TOTO_sh:Event - BSOD"

From this table panel, I use a drilldown in order to display more details

But in this drilldown, I put the search corresponding to the scheduled dashboard search

So when I run my drilldown, I have new events regarding the scheduled search

I know it's normal but is there a solution to hame the same events that there is in my scheduled search even if I dont also use a scheduled search in my dashboard?

Thanks

Re: drilldown best practices

gcusello — Thu, 22 Oct 2020 06:39:35 GMT

Hi @jip31,

you could schedule your search to save results in a summary index, eventually with an higher frequency.

Then you could search in the summary.

In this way you'll have the results updated to the last running and very quickly.

Ciao.

Giuseppe

Re: drilldown best practices

jip31 — Thu, 22 Oct 2020 15:40:45 GMT

I thanks

Re: drilldown best practices

gcusello — Thu, 22 Oct 2020 15:51:26 GMT

Hi @jip31,

good for you!

ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉