Reporting

Is there any reason to schedule a real-time search if it has no alerts?

Jordan_Brough
Path Finder

Is there any benefit to scheduling a saved real-time search if I don't configure any alerts/etc for it?

With non-real-time scheduled searches I understand that I get the benefit of caching the latest data so dashboards & etc load fast, even if I don't have any alerts configured for it. But with real-time scheduled searches is anything cached, or anything like that?

Am I just burning up CPU by running real-time scheduled saved searches that don't have any alert actions?

0 Karma
1 Solution

Jordan_Brough
Path Finder

A little testing seems to show that the benefit of "scheduling" real-time searches is that historical data on dashboards (the non-real-time data) is cached and loads instantaneously when I pull up the dashboard. For our case, the cost of always running the real-time search, even when someone isn't viewing the dashboard, doesn't seem worth the quicker load of historical data.

On the other hand, my testing seems to show that the benefit of having a saved (but doesn't have to be scheduled) real-time search for dashboards is that everyone who loads the dashboard will share the same real-time search job, which can be way more efficient. (thanks gkanapathy)

View solution in original post

Jordan_Brough
Path Finder

A little testing seems to show that the benefit of "scheduling" real-time searches is that historical data on dashboards (the non-real-time data) is cached and loads instantaneously when I pull up the dashboard. For our case, the cost of always running the real-time search, even when someone isn't viewing the dashboard, doesn't seem worth the quicker load of historical data.

On the other hand, my testing seems to show that the benefit of having a saved (but doesn't have to be scheduled) real-time search for dashboards is that everyone who loads the dashboard will share the same real-time search job, which can be way more efficient. (thanks gkanapathy)

gkanapathy
Splunk Employee
Splunk Employee

If it is to be displayed on dashboards that are viewed in more than one place at a time, then having it scheduled allows all the different dashboards and instances of dashboards to use the same scheduled search.

0 Karma

bmunson_splunk
Splunk Employee
Splunk Employee

I have just labbed this and found that splunk runs separate processes for each account looking at the RT dashboard regardless of whether it is a saved RT or a scheduled RT populating it.

Using splunk 5.0.2

0 Karma

Jordan_Brough
Path Finder

Doing some testing, I seem to get the same sharing benefits as long as it's "saved" (doesn't have to be "scheduled"). i.e., looking at the "Jobs" window for all running jobs from all users, if I load the dashboard in multiple browsers with multiple user accounts I only see one job (the one from the first user to load the dashboard) show up.

0 Karma

Jordan_Brough
Path Finder

So if it's "saved" but not "scheduled" then dashboards won't share the search?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...