https://community.splunk.com/t5/Dashboards-Visualizations/Summary-Indexing-and-Performance/m-p/126554#M7470 <P>Hi,</P> <P>You're on the rigth way but you forgoted something or/and you make some mistakes.</P> <P>Summary indexes are there to accelerate the results of searches but it's not the only thing.<BR /> You must know that the first condition to respect so that the performance of your dashboards can be improved is that each of your dashboards most not have more than 8 searches. This condition is essential for splunk to displays and runs correctly your dashboards.</P> <P>So before using Summary indexes, make sure that your dashboards respect that condition.</P> Wed, 18 Mar 2015 10:43:36 GMT NOUMSSI 2015-03-18T10:43:36Z https://community.splunk.com/t5/Dashboards-Visualizations/Summary-Indexing-and-Performance/m-p/126553#M7469 <P>Hi,</P> <P>So i have been looking for ways to improve performance of my dashboards - to give you summary - i currently have 3 Dashboards and each dashboard is running more than 50 Searches at a given time, all the dashboards are hosted on 1 Search head which is feed by 2 indexers for data.</P> <P>i have been reading and seems like Summary Indexing along with Schedule search is solution i am looking but i have few doubts and would greatly appreciate if some on can chime in 2 cents based on past experience:<BR /> 1. I am planning to create 150 Scheduled Searches (none of them is duplicate) to run every 15 Minutes ( i want to run them every 15 minutes because - we need real time dashboard)<BR /> 2. I will then put output of these schedule searches in different summary indexes (because of different people need access to different data)<BR /> 3. Then run my Advanced XML dashboards against these Summary index saved results. </P> <P>Questions i have:<BR /> 1. Is this right move? or is there is anything better which can help improve dashboard performance. (at any given time we can have up-to 20 people logged in and looking at real time dashboards).<BR /> 2. One thing i noted is that Summary Indexes get data from Scheduled Searches which atleast 1 Hour behind in time, why is it so? if my Adv XML is running a search against Summary Index then that means i can never get data which is near real time ? i do not want to wait for 1 hr before data for now shows up on dashboard - am i missing something?</P> Wed, 09 Apr 2014 23:19:54 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Summary-Indexing-and-Performance/m-p/126553#M7469 nikhilmehra79 2014-04-09T23:19:54Z https://community.splunk.com/t5/Dashboards-Visualizations/Summary-Indexing-and-Performance/m-p/126554#M7470 <P>Hi,</P> <P>You're on the rigth way but you forgoted something or/and you make some mistakes.</P> <P>Summary indexes are there to accelerate the results of searches but it's not the only thing.<BR /> You must know that the first condition to respect so that the performance of your dashboards can be improved is that each of your dashboards most not have more than 8 searches. This condition is essential for splunk to displays and runs correctly your dashboards.</P> <P>So before using Summary indexes, make sure that your dashboards respect that condition.</P> Wed, 18 Mar 2015 10:43:36 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Summary-Indexing-and-Performance/m-p/126554#M7470 NOUMSSI 2015-03-18T10:43:36Z