Splunk Search

Inline vs Saved Search

aaronkorn
Splunk Employee
Splunk Employee

Which do you recommend from a OS and search performance perspective and for realtime searches in a dashboard (or close to real time)?

0 Karma

yannK
Splunk Employee
Splunk Employee

if you use the same inline search on several dashboard, they will have to run several time in parallel.
while using a saved search can run it a single one and use the same results for all the dashboards.

other than that, there is not difference between saved and inline.
in general, do not do real time except if you have no other choice (they impact memory, inodes, indexing speed)

saivineet
New Member

thanks bro for your answer .. it really cleared my doubts... 🙂

0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...