saved search to improve the dashboard performance

[selvam_sekar]

Hi,

My dashboard seems to be taking around 1.3 mints to load the data for multiple panels and sometime it takes around 4 mints to load the data. My client come up with an requirement to get 'auto refresh" feature  enabled for the dashboard with 15 mints intervals.

I used base search and the base search intern uses the | tstats. I am not familiar with save search or scheduled serch or loadjob.

Please could you advise? how to implement the feature

Thanks,

Selvam.

[gcusello · Accepted solution]

Hi @selvam_sekar,

you have some methods to accelerate your search that youcan find described at https://docs.splunk.com/Documentation/Splunk/9.1.2/Knowledge/Aboutsummaryindexing

My hint is to use Datamodels or Summary indexes.

About the second, you have to schedule your searches with a frequency to defin based on the time for the search execution and your refresh requirements.

So you can save the results in a summary index and then run your search on the aggregated values that you have in the summary index.

Ciao.

Giuseppe

[selvam_sekar]

sure, thanks for the note @gcusello . summary index or scheduled search both are same?

Please could you suggest, how to implement the scheduled search ?

[gcusello]

Hi @selvam_sekar,

they are two different thing to use in different situations:

sheduled searches can be used when you have a fixed search to display in a panel, e.g. to replace a Real Time Search.

Summeary index is the best solution if you want to pre-elaborate your results and leave the users to aggregate as whey want the already elaborated results.

I usually use summary indexes.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉