I have a monthly dashboard to use and i want to refresh it only once a month and not every time when i open it in splunk. Is there a way to do that?
For e.g.: On every 2nd of month it should get refreshed the data and then during the whole month when ever i visit it, it should show the same data to me.
Use scheduled Savedsearches/reports for building element for your dashboard. You also must extend those ttl to one month, but be careful that you are doing it only for those! Otherwise all your search results are stored for that time and it takes a lot of disk space.
r. Ismo
Set your time period so that it aligns to the month then add a day (or two)
@mon+1d
First ques - where to include it
Second ques - Will it re-run on every visit of dashboard