topic Re: How do i create static reports in Reporting

How do i create static reports

sriram_sathyamo — Thu, 12 Jan 2012 22:44:23 GMT

Typically, when i create a dashboard off splunked data, the dashbaord takes a while to load.
Upper Mgmt typically needs the data to display ASAP.
So, in the following scenario - i need daily volumes for some event for the past 30 days, and i can create a saved search which runs every night at say midnight....and populates the data
Is there any way for me to create a static page that loads automatically with this data....as opposed to waiting for 30 sec-1 min to dynamically load and render the data

Re: How do i create static reports

Damien_Dallimor — Thu, 12 Jan 2012 22:49:07 GMT

Summary Indexing will help to boost your performance :

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usesummaryindexing

Furthermore , you may want to consider using scheduled PDF report generation for Upper Mgmt :

http://docs.splunk.com/Documentation/Splunk/4.3/User/ScheduleDeliveryofDashboardPrintoutsviaEmail

Re: How do i create static reports

sriram_sathyamo — Thu, 12 Jan 2012 22:51:56 GMT

any other ways - summary indexing still takes a 1 min +.
And rather than PDF...is there a way to have the pages within splunk...

Re: How do i create static reports

Damien_Dallimor — Thu, 12 Jan 2012 23:23:51 GMT

So, for example, would your ideal result be to have static html pages that are browseable via the navigation bar ?

Re: How do i create static reports

sriram_sathyamo — Thu, 12 Jan 2012 23:25:52 GMT

that would be absolutely ideal!!!!

Re: How do i create static reports

Damien_Dallimor — Thu, 12 Jan 2012 23:41:58 GMT

Well , I'm thinking a bit outside the box here now...but you could have some Advanced XML views that Upper Mgmt have permission to read, and these views include static html files. The content of these static html files is periodically generated by a scheduled script/program(external to splunk) that uses the Splunk REST API to execute a search command to get your data and a framework like jschart to render the charting in the static html.

There may be a more elegant and integrated way to achieve this, but I'm not aware of it.

Re: How do i create static reports

dwaddle — Fri, 13 Jan 2012 05:26:04 GMT

As Damien mentioned, summary indexing can help, but may not be enough. Also, it's possible to run scheduled searches and save the results of said scheduled searches for use within dashboards (as opposed to running the search at dashboard load time)

However, if response time is paramount, I would highly recommend applying more hardware to your situation. Splunk's search response time is very I/O dependent, and the horizontal scaling of distributed search is designed to help distribute that I/O across many disks in many machines.

Erik Swan's blog post http://blogs.splunk.com/2009/10/27/add-a-server-or-two/ discusses this exact issue. If upper management doesn't have the time to wait a couple of minutes for a dashboard to display, then they should be willing to fund the extra hardware needed to speed your deployment up to their satisfaction.