Dashboards & Visualizations

How do you create a dashboard that can run only once daily so that every time some one opens the dashboard it won't re run the search?

vinillukes
Explorer

The dashboard has around thirty panels and each of the query has at least 3 parameters changing. So it is hard to create a post processing to optimize the dashboard. Is there any way the dashboard will be run once a day like report to improve performance?

0 Karma
1 Solution

kmorris_splunk
Splunk Employee
Splunk Employee

You could use scheduled saved searches for your dashboard panels, rather than ad-hoc searches. So if you schedule your reports to run every hour as an example, then add those reports as panels to a dashboard, the data will be from the last run of the scheduled report.

You could also use real-time scheduled reports. This report type runs in the background at all times. It does not launch a new report instance each time a user loads the dashboard. Instead, it shows results for the currently running real-time scheduled report.

Take a look at this documentation for more details. A good way to test the benefits is to create a simple dashboard with 2 identical panels. One that is a scheduled report and the other that uses an ad-hoc search. You will see the first panel show up faster.

http://docs.splunk.com/Documentation/Splunk/7.1.1/Viz/WorkingWithDashboardPanels

View solution in original post

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

You could use scheduled saved searches for your dashboard panels, rather than ad-hoc searches. So if you schedule your reports to run every hour as an example, then add those reports as panels to a dashboard, the data will be from the last run of the scheduled report.

You could also use real-time scheduled reports. This report type runs in the background at all times. It does not launch a new report instance each time a user loads the dashboard. Instead, it shows results for the currently running real-time scheduled report.

Take a look at this documentation for more details. A good way to test the benefits is to create a simple dashboard with 2 identical panels. One that is a scheduled report and the other that uses an ad-hoc search. You will see the first panel show up faster.

http://docs.splunk.com/Documentation/Splunk/7.1.1/Viz/WorkingWithDashboardPanels

0 Karma

vinillukes
Explorer

That's a good suggestion. But I need to add these scheduled reports inside a form which is already prebuilt. Will savedsearch command help? Also in that case I might have to create around 30 reports. One per dashboard?

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...