Splunk Dashboard Snapshot

[TheLighterHalf]

Is it possible to create a snapshot of the Splunk dashboard so that it does not pull data but only shows a specific time? For example, I'd like to create a snapshot of a dashboard every 30 minutes so folks could go out and view it without pulling data from the server. I'm also not looking to create a PDF or send it out as an email. I'm kind of thinking about publishing it as HTML or possibly just posting an image on a site somewhere. Whenever something happens or an issue comes up we have a lot of people jumping on to check it out and or just check out the car crash and it's creating a big pull that we want to minimize.

[jaxjohnny2000]

Consider using a summary database or lookup table to drive the dashboard. First, schedule a search to run every 30 minutes. That search will populate either the lookup table or the summary table. Then adjust the dashboard to pull from the lookup or summary.

so far as PDF; If you can publish the results to a web site, that may be better. The PDF output needs help.

[richgalloway]

Consider refactoring the dashboard to use saved searches instead of inline searches. Schedule the saved searches to run at the desired interval (could be more often than every 30 minutes). The dashboard will load the most recent results from each search instead of each user triggering new searches. It also means everyone sees the same dashboard.