drilldown best practices

[jip31]

Hello

I used a scheduled search in a table panel of my dashbaord

| loadjob savedsearch="admin:TOTO_sh:Event - BSOD" 

From this table panel, I use a drilldown in order to display more details

But in this drilldown, I put the search corresponding to the scheduled dashboard search

So when I run my drilldown, I have new events regarding the scheduled search

I know it's normal but is there a solution to hame the same events that there is in my scheduled search even if I dont also use a scheduled search in my dashboard?

Thanks

[gcusello · Accepted solution]

Hi @jip31,

you could schedule your search to save results in a summary index, eventually with an higher frequency.

Then you could search in the summary.

In this way you'll have the results updated to the last running and very quickly.

Ciao.

Giuseppe

[jip31]

I thanks

[gcusello]

Hi @jip31,

good for you!

ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉