Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Monitoring Splunk
- :
- Re: Splunk overall performance with auto refresh d...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How autorefresh dashboard will impact the performance of splunk app in general.
So, the dashboard i'm planning to enable auto refresh consisting of 4-5 panels(searches) and will refresh every 40-60 secs.
Will it result to degradation/reliability issues of the app? Knowing that currently there are alerts (via emails) currently configured?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is very common. One dashboard, with efficient construction (using base_search design, etc.) and NOT USING realtime will not create any problems for anybody.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is very common. One dashboard, with efficient construction (using base_search design, etc.) and NOT USING realtime will not create any problems for anybody.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thanks @woodcock . first time to hear the base search and i'm reading about it now. Not using realtime? the dashboards searches the time range now up to 15 mins. DO you think it will impact? I'm just worried as the other alerts are not mine and they might lift their eyebrows on me.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is that 15-minute realtime window? If so, you are creating big problems.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
the xml code consisting the below.
latest = 15minutes
earliest= now
Does this mean realtime searching? i read somewhere that you can also put the word "realtime" to actually parse realtime.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No, that is not realtime. It is fine.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@woodcock .Appreciate your time answering my newbie questions. I'll be implementing base search on the dashboard.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions
Splunk Community Badges!
[Puzzles] Solve, Learn, Repeat: Matching cron expressions
