Dashboards & Visualizations

Graph of log count only and avoid search result system load because there are soooo many events to return.


I have a few searches I want to dashboard that display log events over a week, then another graph for events over a month.

The problem is that there are millions of events weekly and am curious if there is an optimized way I can display log counts w/o a huge search that will take too long.

So really to query the number of items, but not return event specific detail/results.


Tags (1)
0 Karma

Revered Legend

It would be tough to suggest you something without looking at your queries, but you can utilize summary indexing to pre-calculate the daily/weekly/monthly summary data you want and run your dashboard on summary data. See more details here




0 Karma
Get Updates on the Splunk Community!

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...