Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Reporting
- :
- How to configure Static weekly report on dashboard
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
I want to reduce the search load on Splunk machine each time the user views a dashboard. Can we have a report run weekly say every sunday midnight? Which will save the report for the past week. The user will be able to view only last weeks report in the current week.
Is this possible with splunk? If yes, please tell how to.
Thanks Viv
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, it is possible.
But if your search performs data aggregation (timechart, stats, chart,...) you might want to use summary indexing instead... Which kind of search is that?
To re-use a search results in a dashboard you basically have to:
- build a saved search that will feed your view (it will gather 1 week worth of data),
- schedule that search to run weekly (use the CRON syntax, read up the cron_schedule param in the conf),
- build an advanced view which uses that saved search,
- configure the HiddenSavedSearch module to use the saved search history instead of re-running it (set "useHistory" param to "True").
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, it is possible.
But if your search performs data aggregation (timechart, stats, chart,...) you might want to use summary indexing instead... Which kind of search is that?
To re-use a search results in a dashboard you basically have to:
- build a saved search that will feed your view (it will gather 1 week worth of data),
- schedule that search to run weekly (use the CRON syntax, read up the cron_schedule param in the conf),
- build an advanced view which uses that saved search,
- configure the HiddenSavedSearch module to use the saved search history instead of re-running it (set "useHistory" param to "True").
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Is this functionality also available in Simple XML Dashboards?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You're welcome!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey Paolo
Thanks for the detailed steps.
I could configure it on our splunk.
Resolved our issue, I appreciate your help.
Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA
.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...
A Season of Skills: New Splunk Courses to Light Up Your Learning Journey
