Dashboards & Visualizations

saved search to improve the dashboard performance

selvam_sekar
Path Finder

Hi,

My dashboard seems to be taking around 1.3 mints to load the data for multiple panels and sometime it takes around 4 mints to load the data. My client come up with an requirement to get 'auto refresh" feature  enabled for the dashboard with 15 mints intervals.

I used base search and the base search intern uses the | tstats. I am not familiar with save search or scheduled serch or loadjob.

Please could you advise? how to implement the feature

Thanks,

Selvam.

 

Labels (2)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @selvam_sekar,

you have some methods to accelerate your search that youcan find described at https://docs.splunk.com/Documentation/Splunk/9.1.2/Knowledge/Aboutsummaryindexing

My hint is to use Datamodels or Summary indexes.

About the second, you have to schedule your searches with a frequency to defin based on the time for the search execution and your refresh requirements.

So you can save the results in a summary index and then run your search on the aggregated values that you have in the summary index.

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @selvam_sekar,

you have some methods to accelerate your search that youcan find described at https://docs.splunk.com/Documentation/Splunk/9.1.2/Knowledge/Aboutsummaryindexing

My hint is to use Datamodels or Summary indexes.

About the second, you have to schedule your searches with a frequency to defin based on the time for the search execution and your refresh requirements.

So you can save the results in a summary index and then run your search on the aggregated values that you have in the summary index.

Ciao.

Giuseppe

0 Karma

selvam_sekar
Path Finder

sure, thanks for the note @gcusello . summary index or scheduled search both are same?

 

Please could you suggest, how to implement the scheduled search ?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @selvam_sekar,

they are two different thing to use in different situations:

sheduled searches can be used when you have a fixed search to display in a panel, e.g. to replace a Real Time Search.

Summeary index is the best solution if you want to pre-elaborate your results and leave the users to aggregate as whey want the already elaborated results.

I usually use summary indexes.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...