All Apps and Add-ons

How to cache app dashboard to avoid search query every time in Splunk 6.2?

splunk_mkhan
Explorer

I am a new splunk user, I am using trial version of splunk 6.2.
I have made few splunk dashboard to show pie chart of index data. When I am opening these dashboard its taking some time to load data from splunk database. I want to cache these dashboard to avoid loading index every time.
Please help me to achieve this step by step in Splunk 6.2(trial version).
Thanks,
yusuf

Tags (1)
1 Solution

jtrucks
Splunk Employee
Splunk Employee

Edit your scheduled report to be accelerated, then ensure your dashboard uses the Report, not an inline search. This way the dashboard will call up the cached results from the accelerated data. In addition, if the dashboard has multiple panels all based on the same search but doing different things to the data, you can set a base search in your dashboard and it only performs that search once for the whole dashboard, not for every panel.

For more information, see:

http://docs.splunk.com/Documentation/Splunk/6.2.3/Report/Acceleratereports
http://docs.splunk.com/Documentation/Splunk/6.2.3/AdvancedDev/PostProcess

--
Jesse Trucks
Minister of Magic

View solution in original post

0 Karma

jtrucks
Splunk Employee
Splunk Employee

Edit your scheduled report to be accelerated, then ensure your dashboard uses the Report, not an inline search. This way the dashboard will call up the cached results from the accelerated data. In addition, if the dashboard has multiple panels all based on the same search but doing different things to the data, you can set a base search in your dashboard and it only performs that search once for the whole dashboard, not for every panel.

For more information, see:

http://docs.splunk.com/Documentation/Splunk/6.2.3/Report/Acceleratereports
http://docs.splunk.com/Documentation/Splunk/6.2.3/AdvancedDev/PostProcess

--
Jesse Trucks
Minister of Magic
0 Karma

splunk_mkhan
Explorer

Thanks for reply jtrucks,
When I am selecting setting option "Report acceleration summaries", showing message
"Report Acceleration Summaries
This is an Enterprise-level feature. It is not available with the installed set of licenses."

Please help me to cache dashboard in trial version.

0 Karma

splunk_mkhan
Explorer

I want to schedule to load dashboard in 24 hours once.

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...