Reporting

How to configure Static weekly report on dashboard

viv
New Member

Hi

I want to reduce the search load on Splunk machine each time the user views a dashboard. Can we have a report run weekly say every sunday midnight? Which will save the report for the past week. The user will be able to view only last weeks report in the current week.

Is this possible with splunk? If yes, please tell how to.

Thanks Viv

Tags (2)
0 Karma
1 Solution

Paolo_Prigione
Builder

Yes, it is possible.

But if your search performs data aggregation (timechart, stats, chart,...) you might want to use summary indexing instead... Which kind of search is that?

To re-use a search results in a dashboard you basically have to:

  • build a saved search that will feed your view (it will gather 1 week worth of data),
  • schedule that search to run weekly (use the CRON syntax, read up the cron_schedule param in the conf),
  • build an advanced view which uses that saved search,
  • configure the HiddenSavedSearch module to use the saved search history instead of re-running it (set "useHistory" param to "True").

View solution in original post

Paolo_Prigione
Builder

Yes, it is possible.

But if your search performs data aggregation (timechart, stats, chart,...) you might want to use summary indexing instead... Which kind of search is that?

To re-use a search results in a dashboard you basically have to:

  • build a saved search that will feed your view (it will gather 1 week worth of data),
  • schedule that search to run weekly (use the CRON syntax, read up the cron_schedule param in the conf),
  • build an advanced view which uses that saved search,
  • configure the HiddenSavedSearch module to use the saved search history instead of re-running it (set "useHistory" param to "True").

View solution in original post

goelli
Communicator

Hi,
Is this functionality also available in Simple XML Dashboards?

0 Karma

Paolo_Prigione
Builder

You're welcome!

0 Karma

viv
New Member

Hey Paolo
Thanks for the detailed steps.
I could configure it on our splunk.

Resolved our issue, I appreciate your help.

0 Karma