topic How to configure Static weekly report on dashboard in Reporting

How to configure Static weekly report on dashboard

viv — Mon, 04 Apr 2011 13:51:04 GMT

I want to reduce the search load on Splunk machine each time the user views a dashboard. Can we have a report run weekly say every sunday midnight? Which will save the report for the past week. The user will be able to view only last weeks report in the current week.

Is this possible with splunk? If yes, please tell how to.

Thanks Viv

Re: How to configure Static weekly report on dashboard

Paolo_Prigione — Mon, 04 Apr 2011 23:31:45 GMT

Yes, it is possible.

But if your search performs data aggregation (timechart, stats, chart,...) you might want to use summary indexing instead... Which kind of search is that?

To re-use a search results in a dashboard you basically have to:

build a saved search that will feed your view (it will gather 1 week worth of data),
schedule that search to run weekly (use the CRON syntax, read up the cron_schedule param in the conf),
build an advanced view which uses that saved search,
configure the HiddenSavedSearch module to use the saved search history instead of re-running it (set "useHistory" param to "True").

Re: How to configure Static weekly report on dashboard

viv — Tue, 05 Apr 2011 15:13:38 GMT

Hey Paolo
Thanks for the detailed steps.
I could configure it on our splunk.

Resolved our issue, I appreciate your help.

Re: How to configure Static weekly report on dashboard

Paolo_Prigione — Tue, 05 Apr 2011 17:30:14 GMT

You're welcome!

Re: How to configure Static weekly report on dashboard

goelli — Wed, 11 Mar 2015 15:51:36 GMT

Hi,
Is this functionality also available in Simple XML Dashboards?