Is there a way to load the whole dashboard, e.g. twice a day, and for everyone who opens the dashboard show previously loaded results?
I've read about summary indexing but we use too many searches(not saved searches) in each dashboard and number of dashboards is also high. Each of the searches is heavy and moreover they are grouped together with other heavy-searches in a dashboard and it's not a solution to discretize one dashbouard to several ones.
So it would be very useful to cover the needs for dashboards by a single action for each of them.
When you say that you use too many searches to use summary indexing, what do you mean by that? What kind of limit do you mean you're hitting?
There are two main options that I can think of. One is that, to use summary indexing. The other one is to use saved searches that you put a schedule on, and have your dashboards use the cached results from these saved searches. Depending on which option you find more interesting (or if none of them is for some reason), I can update my answer with more specific information.
Ayn, thanks for the proposals. Both of them use indexes or cached results for every single saved search. We didn't use saved searches at all and now we have nearly two dozens of views with at least a dosen of searches in each. So changing them all into saved searches and changing view according to this isn't the fastest way.. So that's why I was wondering did splunk functionality has a solution to make it faster)