How do you create a dashboard that can run only once daily so that every time some one opens the dashboard it won't re run the search?

[vinillukes]

The dashboard has around thirty panels and each of the query has at least 3 parameters changing. So it is hard to create a post processing to optimize the dashboard. Is there any way the dashboard will be run once a day like report to improve performance?

[kmorris_splunk · Accepted solution]

You could use scheduled saved searches for your dashboard panels, rather than ad-hoc searches. So if you schedule your reports to run every hour as an example, then add those reports as panels to a dashboard, the data will be from the last run of the scheduled report.

You could also use real-time scheduled reports. This report type runs in the background at all times. It does not launch a new report instance each time a user loads the dashboard. Instead, it shows results for the currently running real-time scheduled report.

Take a look at this documentation for more details. A good way to test the benefits is to create a simple dashboard with 2 identical panels. One that is a scheduled report and the other that uses an ad-hoc search. You will see the first panel show up faster.

http://docs.splunk.com/Documentation/Splunk/7.1.1/Viz/WorkingWithDashboardPanels

[vinillukes]

That's a good suggestion. But I need to add these scheduled reports inside a form which is already prebuilt. Will savedsearch command help? Also in that case I might have to create around 30 reports. One per dashboard?