How to configure Static weekly report on dashboard

[viv]

Hi

I want to reduce the search load on Splunk machine each time the user views a dashboard. Can we have a report run weekly say every sunday midnight? Which will save the report for the past week. The user will be able to view only last weeks report in the current week.

Is this possible with splunk? If yes, please tell how to.

Thanks Viv

[Paolo_Prigione · Accepted solution]

Yes, it is possible.

But if your search performs data aggregation (timechart, stats, chart,...) you might want to use summary indexing instead... Which kind of search is that?

To re-use a search results in a dashboard you basically have to:

• build a saved search that will feed your view (it will gather 1 week worth of data),
• schedule that search to run weekly (use the CRON syntax, read up the cron_schedule param in the conf),
• build an advanced view which uses that saved search,
• configure the HiddenSavedSearch module to use the saved search history instead of re-running it (set "useHistory" param to "True").

[goelli]

Hi,
Is this functionality also available in Simple XML Dashboards?

[Paolo_Prigione]

You're welcome!

[viv]

Hey Paolo
Thanks for the detailed steps.
I could configure it on our splunk.

Resolved our issue, I appreciate your help.