All Apps and Add-ons

How to cache app dashboard to avoid search query every time in Splunk 6.2?

splunk_mkhan
Explorer

I am a new splunk user, I am using trial version of splunk 6.2.
I have made few splunk dashboard to show pie chart of index data. When I am opening these dashboard its taking some time to load data from splunk database. I want to cache these dashboard to avoid loading index every time.
Please help me to achieve this step by step in Splunk 6.2(trial version).
Thanks,
yusuf

Tags (1)
1 Solution

jtrucks
Splunk Employee
Splunk Employee

Edit your scheduled report to be accelerated, then ensure your dashboard uses the Report, not an inline search. This way the dashboard will call up the cached results from the accelerated data. In addition, if the dashboard has multiple panels all based on the same search but doing different things to the data, you can set a base search in your dashboard and it only performs that search once for the whole dashboard, not for every panel.

For more information, see:

http://docs.splunk.com/Documentation/Splunk/6.2.3/Report/Acceleratereports
http://docs.splunk.com/Documentation/Splunk/6.2.3/AdvancedDev/PostProcess

--
Jesse Trucks
Minister of Magic

View solution in original post

0 Karma

jtrucks
Splunk Employee
Splunk Employee

Edit your scheduled report to be accelerated, then ensure your dashboard uses the Report, not an inline search. This way the dashboard will call up the cached results from the accelerated data. In addition, if the dashboard has multiple panels all based on the same search but doing different things to the data, you can set a base search in your dashboard and it only performs that search once for the whole dashboard, not for every panel.

For more information, see:

http://docs.splunk.com/Documentation/Splunk/6.2.3/Report/Acceleratereports
http://docs.splunk.com/Documentation/Splunk/6.2.3/AdvancedDev/PostProcess

--
Jesse Trucks
Minister of Magic
0 Karma

splunk_mkhan
Explorer

Thanks for reply jtrucks,
When I am selecting setting option "Report acceleration summaries", showing message
"Report Acceleration Summaries
This is an Enterprise-level feature. It is not available with the installed set of licenses."

Please help me to cache dashboard in trial version.

0 Karma

splunk_mkhan
Explorer

I want to schedule to load dashboard in 24 hours once.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...