Dashboards & Visualizations

How do you create a dashboard that can run only once daily so that every time some one opens the dashboard it won't re run the search?

vinillukes
Explorer

The dashboard has around thirty panels and each of the query has at least 3 parameters changing. So it is hard to create a post processing to optimize the dashboard. Is there any way the dashboard will be run once a day like report to improve performance?

0 Karma
1 Solution

kmorris_splunk
Splunk Employee
Splunk Employee

You could use scheduled saved searches for your dashboard panels, rather than ad-hoc searches. So if you schedule your reports to run every hour as an example, then add those reports as panels to a dashboard, the data will be from the last run of the scheduled report.

You could also use real-time scheduled reports. This report type runs in the background at all times. It does not launch a new report instance each time a user loads the dashboard. Instead, it shows results for the currently running real-time scheduled report.

Take a look at this documentation for more details. A good way to test the benefits is to create a simple dashboard with 2 identical panels. One that is a scheduled report and the other that uses an ad-hoc search. You will see the first panel show up faster.

http://docs.splunk.com/Documentation/Splunk/7.1.1/Viz/WorkingWithDashboardPanels

View solution in original post

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

You could use scheduled saved searches for your dashboard panels, rather than ad-hoc searches. So if you schedule your reports to run every hour as an example, then add those reports as panels to a dashboard, the data will be from the last run of the scheduled report.

You could also use real-time scheduled reports. This report type runs in the background at all times. It does not launch a new report instance each time a user loads the dashboard. Instead, it shows results for the currently running real-time scheduled report.

Take a look at this documentation for more details. A good way to test the benefits is to create a simple dashboard with 2 identical panels. One that is a scheduled report and the other that uses an ad-hoc search. You will see the first panel show up faster.

http://docs.splunk.com/Documentation/Splunk/7.1.1/Viz/WorkingWithDashboardPanels

0 Karma

vinillukes
Explorer

That's a good suggestion. But I need to add these scheduled reports inside a form which is already prebuilt. Will savedsearch command help? Also in that case I might have to create around 30 reports. One per dashboard?

0 Karma
Get Updates on the Splunk Community!

Changes to Splunk Instructor-Led Training Completion Criteria

We’re excited to share an update to our instructor-led training program that enhances the learning experience ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

❄️ Welcome the new year with our January lineup of Community Office Hours, Tech Talks, and Webinars! 🎉 ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...