How to quickly update transaction count on a dashboard?

[randymoore]

Hello everyone,

We have a dashboard that displays the number of transactions for the day, as a single value panel. The search is very simple and easy as each transaction is a separate event in the log:

index=my_index category=transaction | stats count

The dashboard refreshes every 5 minutes. Which means that Splunk recounts them every 5 minutes to come up with the new count. What happens is that during our busy time of the year, the number of transactions arriving exceed 5 minute refresh time it takes Splunk to finish counting them.

What I would love is for Splunk to “remember” the last count of transactions (say it was 7,500,000) and start counting from there. That way, the count is accurate, and the Splunk processing is not as great (hopefully).

I just don’t know how to do that, or if it can be done. Any ideas?

[nravichandran]

One of the option could be to use KV Store to Persist data, but for that particular session.

[randymoore]

Looking into that next. Will update by the begining of next week hopefully.

[sundareshr · Accepted solution]

Have you looked at Accelerated Reports?

[randymoore]

Thanks for the pointer to Accelerated Reports. I enabled that for the dashboard panel. I'll time it over the next few days to see if it works as I expect.

[randymoore]

Ran a stress test and using Accelerated Reports worked like I wanted it to. Thanks!