I have a scheduled report in Splunk that runs nightly. It is accelerated for 7 days and runs back in time for 7 days also.
This report provides me comprehensive information about all my assets and respective information.
The report has about 10 million statistical records for our assets as we need.
When I reference my dashboard panels using this report, they error out complaining about "error fetching data" and it seems like it a huge data set thats why because it is fine with smaller data set. But when I open a report as normal in reports, it loads in less than 5 seconds.
I need to know if I add a report in a dashboard as a table, which I do, BUT is it possible to add dropdown filter menus to parse information from that huge report table or even the report by itself? OR how do I get the dashboard panels to load quicker when digging through this large report?
Report contents example:
Host, Barcode, Company, BusinessUnit, Location, ContactPerson
I want filters for Company, BusinessUnit, Location, ContactPerson so I can list Host, Barcode information associated with the selection from this huge data.
Where is the result of your accelerated report stored? Is that in an index or CSV file? In the dashboard, you can have a time picker to restrict the time range and additional fields to load by default [ as required]. Based on the filters selected by user, you can run the search against your index/lookup. If you have multiple panels, use base and post process search approach.
And if you still suffer with performance, you might want to look at creating a custom datamodel and storing the results/fields and use DM acceleration to get additional benefits and use tstats in your dashboards for performance.
Hi Lakshman, I figured a way via base and post process. Still taking long but a lot better than before! 🙂 TY!!
Glad it worked, pls accept the solution to close the thread. I also suggest to look at having a custom datamodel created for your use case with required fields and accelerate it, so you can use tstats to further improve performance.