Is it possible to run dashboard panel searches in a staggered sequence instead of all at once?

[Ant1D]

Hey,

I have a dashboard with 6 charts. When I open this dashboard in my browser, Splunk attempts to run all 6 searches at the same time to produce these 6 charts. Is there a way to stagger the running of these searches when the dashboard is opened?
Essentially I would like the first chart to load before the second chart starts to load, I would like the second chart to finish loading before the third chart search is executed and so forth.

Post processing is not the answer because the searches are unrelated (the 6 charts are from 6 different unrelated indexes).

Thanks in advance for your help.

[arlington]

Check out this post. There are actually several nice workarounds:

https://answers.splunk.com/answers/511694/i-have-6-panels-on-a-dashboard-but-can-only-run-3.html

[moesaidi]

I second @AntD
This sounds like a very nice feature to include in an upcoming release of Splunk (ability to stagger panels so they load one at a time, or 3 at a time, etc..)

[gkanapathy · Accepted solution]

Maybe but not exactly. Splunk has limits on the number of concurrent searches that may be run on the search head. This can be set globally, but can also be set by role and as a shared total for everyone in a role. If you reach that limit, then searches will be queued. In practice, this means you can't limit a dashboard specifically to do this. But it does mean you can cause this to happen for specific people for all dashboards.

[Ant1D]

Hi gkanapathy, thanks for your feedback. I understand although this workaround will be cumbersome to manage. I think this is something for Splunk maybe to implement in a future version of Splunk.