speeding up splunk dashboard load time

[aaronkorn]

What is the best approach to speed up dashboard load times? Most of our searches are inline and have to sift through massive amounts of data for about an 8 Hr window. Would saved searches be the recommended way to go to speed up the times or is there a way to cache the search results so it loads quicker the next time. We previously had a realtime dashboard but it used so much cpu/memory that we removed that and we just refresh the dashboard every 10 min.

Thanks!

[Ayn]

Well saved searches WOULD be how you would cache results. Have a saved search run on a scheduled and then set a TTL on its results so that the dashboard always can grab fresh cached results. For instance you could run the saved search every 30 minutes and have a TTL of 35 minutes or so...or whatever time is acceptable to lag behind. Then configure your dashboard accordingly so it uses these cached results from the saved search rather than using inline searches which always have to run right when the user loads the dashboard.

Other alternatives you could consider are summary indexing and report acceleration (I don't have much experience with the latter so I can't really say how well it could apply to your situation).

[BenjaminWyatt]

Just change the module from "HiddenSearch" to "HiddenSavedSearch" and adjust the params accordingly (you can look at the module reference to see the differences).

[aaronkorn]

how do you configure the dashboard to use the cached results?

[ChrisG]

You can read about summary indexing and report acceleration in the Knowledge Manager Manual: http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Aboutsummaryindexing