Splunk Search
Highlighted

Inline vs Saved Search

Splunk Employee
Splunk Employee

Which do you recommend from a OS and search performance perspective and for realtime searches in a dashboard (or close to real time)?

0 Karma
Highlighted

Re: Inline vs Saved Search

Splunk Employee
Splunk Employee

if you use the same inline search on several dashboard, they will have to run several time in parallel.
while using a saved search can run it a single one and use the same results for all the dashboards.

other than that, there is not difference between saved and inline.
in general, do not do real time except if you have no other choice (they impact memory, inodes, indexing speed)

Highlighted

Re: Inline vs Saved Search

New Member

thanks bro for your answer .. it really cleared my doubts... 🙂

0 Karma