What are some of the best practices for scheduled searches?

[yanlajeunesse]

Hello,

I'm still very new to Splunk.

I have a dashboard with a search, and users can choose between the last 24 hours, the last 30 days, the last 90 days, or the last year.
For the last 24 hours, it should never get too slow, and to let users the 'freshest' data, I leave it as an inline search. However, for the longer searches, users are mainly looking at trends, and so I thought the best way to speed everything up would be with a scheduled search that runs say, once a day.
This works absolutely fine, but I don't want to make a scheduled search for 30 days, another scheduled search for 90 days and yet another for a year. I assume there's a way to simply scheduled a search for a year to run everyday, and for the smaller time ranges i could just pick my results from it. I've been searching a lot about datasets, data models, scheduled searches but I can't quite find the best way to do this.

Thank you!

[somesoni2 · Accepted solution]

IMO, setting up accelerated data models would be the recommended approach where it generate the trend data/statistics you want for specified period and it's self-repairing (for gaps). See this for more information on the that.
http://docs.splunk.com/Documentation/Splunk/7.0.0/Knowledge/Acceleratedatamodels

Another option is to setup summary indexing (say daily generate the reporting data) for your data and use summary index for your dashboard. See this for more information.http://docs.splunk.com/Documentation/Splunk/6.6.3/Knowledge/Usesummaryindexing

[yanlajeunesse]

Thank you! I don't know how to accept this as an answer, but it is what I need, I will dive into data models as it seems the most appropriate for my issue.

[skoelpin]

I converted @someson2's comment to an answer. Feel free to accept it 🙂

[skoelpin]

Yep, I second @somesoni2 about the accelerated data models. Depending on how large your summary range is will depend on how much disk space you use (Be careful with selecting ALL-TIME).

I prefer data models over summary indexes but there's some cases where it makes sense.