Monitoring Splunk

Splunk overall performance with auto refresh dashboards

newbie09
Explorer

How autorefresh dashboard will impact the performance of splunk app in general.
So, the dashboard i'm planning to enable auto refresh consisting of 4-5 panels(searches) and will refresh every 40-60 secs.
Will it result to degradation/reliability issues of the app? Knowing that currently there are alerts (via emails) currently configured?

Labels (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

This is very common. One dashboard, with efficient construction (using base_search design, etc.) and NOT USING realtime will not create any problems for anybody.

View solution in original post

0 Karma

woodcock
Esteemed Legend

This is very common. One dashboard, with efficient construction (using base_search design, etc.) and NOT USING realtime will not create any problems for anybody.

View solution in original post

0 Karma

newbie09
Explorer

thanks @woodcock . first time to hear the base search and i'm reading about it now. Not using realtime? the dashboards searches the time range now up to 15 mins. DO you think it will impact? I'm just worried as the other alerts are not mine and they might lift their eyebrows on me.

0 Karma

woodcock
Esteemed Legend

Is that 15-minute realtime window? If so, you are creating big problems.

0 Karma

newbie09
Explorer

the xml code consisting the below.

latest = 15minutes
earliest= now

Does this mean realtime searching? i read somewhere that you can also put the word "realtime" to actually parse realtime.

0 Karma

woodcock
Esteemed Legend

No, that is not realtime. It is fine.

newbie09
Explorer

@woodcock .Appreciate your time answering my newbie questions. I'll be implementing base search on the dashboard.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.