Monitoring Splunk

Splunk overall performance with auto refresh dashboards

newbie09
Explorer

How autorefresh dashboard will impact the performance of splunk app in general.
So, the dashboard i'm planning to enable auto refresh consisting of 4-5 panels(searches) and will refresh every 40-60 secs.
Will it result to degradation/reliability issues of the app? Knowing that currently there are alerts (via emails) currently configured?

Labels (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

This is very common. One dashboard, with efficient construction (using base_search design, etc.) and NOT USING realtime will not create any problems for anybody.

View solution in original post

0 Karma

woodcock
Esteemed Legend

This is very common. One dashboard, with efficient construction (using base_search design, etc.) and NOT USING realtime will not create any problems for anybody.

0 Karma

newbie09
Explorer

thanks @woodcock . first time to hear the base search and i'm reading about it now. Not using realtime? the dashboards searches the time range now up to 15 mins. DO you think it will impact? I'm just worried as the other alerts are not mine and they might lift their eyebrows on me.

0 Karma

woodcock
Esteemed Legend

Is that 15-minute realtime window? If so, you are creating big problems.

0 Karma

newbie09
Explorer

the xml code consisting the below.

latest = 15minutes
earliest= now

Does this mean realtime searching? i read somewhere that you can also put the word "realtime" to actually parse realtime.

0 Karma

woodcock
Esteemed Legend

No, that is not realtime. It is fine.

newbie09
Explorer

@woodcock .Appreciate your time answering my newbie questions. I'll be implementing base search on the dashboard.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...