Dashboards & Visualizations

saved search to improve the dashboard performance

selvam_sekar
Path Finder

Hi,

My dashboard seems to be taking around 1.3 mints to load the data for multiple panels and sometime it takes around 4 mints to load the data. My client come up with an requirement to get 'auto refresh" feature  enabled for the dashboard with 15 mints intervals.

I used base search and the base search intern uses the | tstats. I am not familiar with save search or scheduled serch or loadjob.

Please could you advise? how to implement the feature

Thanks,

Selvam.

 

Labels (2)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @selvam_sekar,

you have some methods to accelerate your search that youcan find described at https://docs.splunk.com/Documentation/Splunk/9.1.2/Knowledge/Aboutsummaryindexing

My hint is to use Datamodels or Summary indexes.

About the second, you have to schedule your searches with a frequency to defin based on the time for the search execution and your refresh requirements.

So you can save the results in a summary index and then run your search on the aggregated values that you have in the summary index.

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @selvam_sekar,

you have some methods to accelerate your search that youcan find described at https://docs.splunk.com/Documentation/Splunk/9.1.2/Knowledge/Aboutsummaryindexing

My hint is to use Datamodels or Summary indexes.

About the second, you have to schedule your searches with a frequency to defin based on the time for the search execution and your refresh requirements.

So you can save the results in a summary index and then run your search on the aggregated values that you have in the summary index.

Ciao.

Giuseppe

0 Karma

selvam_sekar
Path Finder

sure, thanks for the note @gcusello . summary index or scheduled search both are same?

 

Please could you suggest, how to implement the scheduled search ?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @selvam_sekar,

they are two different thing to use in different situations:

sheduled searches can be used when you have a fixed search to display in a panel, e.g. to replace a Real Time Search.

Summeary index is the best solution if you want to pre-elaborate your results and leave the users to aggregate as whey want the already elaborated results.

I usually use summary indexes.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...