Dashboards & Visualizations

How can I save results of search to dashboard every 24 hours?

zhatsispgx
Path Finder

I have a very slow search that I would like to schedule and save the results in a dashboard so the search doesn't have to rerun. The search is extremely slow because it uses transaction across hundreds of thousands of log events.

What I would like to have is a search that runs once every 24 hours, saves the results from the job to a dashboard.

sourcetype="cisco:esa:textmail"
| transaction mid
| search reason="content filter:Auto_Notify"
| table mid, sender, recipient, file_name, attachment_type, subject, quarantine_dest, vendor_action, reason
0 Karma

micahkemp
Champion

This seems like a prime case for summary indexing. Run this search every so often, save the results to a summary index, use the summary index on your dashboard.

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...