How do i create static reports

[sriram_sathyamo]

Typically, when i create a dashboard off splunked data, the dashbaord takes a while to load.
Upper Mgmt typically needs the data to display ASAP.
So, in the following scenario - i need daily volumes for some event for the past 30 days, and i can create a saved search which runs every night at say midnight....and populates the data
Is there any way for me to create a static page that loads automatically with this data....as opposed to waiting for 30 sec-1 min to dynamically load and render the data

[dwaddle]

As Damien mentioned, summary indexing can help, but may not be enough. Also, it's possible to run scheduled searches and save the results of said scheduled searches for use within dashboards (as opposed to running the search at dashboard load time)

However, if response time is paramount, I would highly recommend applying more hardware to your situation. Splunk's search response time is very I/O dependent, and the horizontal scaling of distributed search is designed to help distribute that I/O across many disks in many machines.

Erik Swan's blog post http://blogs.splunk.com/2009/10/27/add-a-server-or-two/ discusses this exact issue. If upper management doesn't have the time to wait a couple of minutes for a dashboard to display, then they should be willing to fund the extra hardware needed to speed your deployment up to their satisfaction.

[Damien_Dallimor]

Well , I'm thinking a bit outside the box here now...but you could have some Advanced XML views that Upper Mgmt have permission to read, and these views include static html files. The content of these static html files is periodically generated by a scheduled script/program(external to splunk) that uses the Splunk REST API to execute a search command to get your data and a framework like jschart to render the charting in the static html.

There may be a more elegant and integrated way to achieve this, but I'm not aware of it.

[sriram_sathyamo]

that would be absolutely ideal!!!!

[sriram_sathyamo]

any other ways - summary indexing still takes a 1 min +.
And rather than PDF...is there a way to have the pages within splunk...

[Damien_Dallimor]

So, for example, would your ideal result be to have static html pages that are browseable via the navigation bar ?

[Damien_Dallimor]

Summary Indexing will help to boost your performance :

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usesummaryindexing

Furthermore , you may want to consider using scheduled PDF report generation for Upper Mgmt :

http://docs.splunk.com/Documentation/Splunk/4.3/User/ScheduleDeliveryofDashboardPrintoutsviaEmail