Dashboards & Visualizations

Dashboard Best practices | Load only a part of dashboard

saveriobocca
Loves-to-Learn Lots

Good morning guys,

I'm currently working on an analytics dashboard on the app
Splunk Enterprise security.
The dashboard consists of many modules and panels. For example there are several
sections that can only be shown by selecting a radio buttom.

The problem is the best practices of the dashboard.
The dashboard every time updates internally causing slowdowns.

It would be possible to update the dashboard (and therefore the panels) only
when i select the radio buttom?

Ultimately to make sure that the dashboard does not update in full at each refresh?

Thank you all,
Xavier

Labels (1)
0 Karma

HaxUez
Explorer

It depends on how you have your dashboard built.  If you didn't change the source, and each panel is its own query you can edit the dashboard, click on the edit search icon and choose an appropriate refresh interval for each panel  independently. 

 

Edit Search Options.PNG

0 Karma

saveriobocca
Loves-to-Learn Lots

Hi HaxUez,

Thanks for the reply.

The entire dashboard is already set to "no auto refresh" as recommended.

I wanted to know in detail if, programmatically, it is possible to activate and inhibit the automatic search based on the selected radio button.

Consider that there is a time picker which, when modified, updates the dashboard in real time.

Can I programmatically set / unset the searches?

Thanks so much,
Xavier

0 Karma

HaxUez
Explorer

Sounds like you are using a time picker to update the entire dashboard. A suggestion would be to set the panels to not refresh, and insert a time picker into each panel via edit source and not use a shared time picker.  You would have to add the following to each panel and change field1, field2 etc.  

 

<input type="time" token="field1">
<label>Time Picker</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>

0 Karma

saveriobocca
Loves-to-Learn Lots

Hi @HaxUez ,

unfortunately the time picker must necessarily be shared.
I need to be able to update the entire dashboard at times with the same time picker.

Being a not very light dashboard at a computational level, I opted for a solution relating to the freeze of the various sections based on a choice via radio button (section1, section2, etc)

Is it therefore not possible to inhibit various sections from the automatic update and load them one at a time?

Thanks so much,
Xavier

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...