Dashboards & Visualizations

How do you create a dashboard that can run only once daily so that every time some one opens the dashboard it won't re run the search?

vinillukes
Explorer

The dashboard has around thirty panels and each of the query has at least 3 parameters changing. So it is hard to create a post processing to optimize the dashboard. Is there any way the dashboard will be run once a day like report to improve performance?

0 Karma
1 Solution

kmorris_splunk
Splunk Employee
Splunk Employee

You could use scheduled saved searches for your dashboard panels, rather than ad-hoc searches. So if you schedule your reports to run every hour as an example, then add those reports as panels to a dashboard, the data will be from the last run of the scheduled report.

You could also use real-time scheduled reports. This report type runs in the background at all times. It does not launch a new report instance each time a user loads the dashboard. Instead, it shows results for the currently running real-time scheduled report.

Take a look at this documentation for more details. A good way to test the benefits is to create a simple dashboard with 2 identical panels. One that is a scheduled report and the other that uses an ad-hoc search. You will see the first panel show up faster.

http://docs.splunk.com/Documentation/Splunk/7.1.1/Viz/WorkingWithDashboardPanels

View solution in original post

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

You could use scheduled saved searches for your dashboard panels, rather than ad-hoc searches. So if you schedule your reports to run every hour as an example, then add those reports as panels to a dashboard, the data will be from the last run of the scheduled report.

You could also use real-time scheduled reports. This report type runs in the background at all times. It does not launch a new report instance each time a user loads the dashboard. Instead, it shows results for the currently running real-time scheduled report.

Take a look at this documentation for more details. A good way to test the benefits is to create a simple dashboard with 2 identical panels. One that is a scheduled report and the other that uses an ad-hoc search. You will see the first panel show up faster.

http://docs.splunk.com/Documentation/Splunk/7.1.1/Viz/WorkingWithDashboardPanels

0 Karma

vinillukes
Explorer

That's a good suggestion. But I need to add these scheduled reports inside a form which is already prebuilt. Will savedsearch command help? Also in that case I might have to create around 30 reports. One per dashboard?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...