Splunk Search

Real-time charts - Query once, view many?

alekksi
Communicator

Hi all,

We have a splunk setup where we are investigating a way of having a shared streaming dashboard that can be used by multiple people at the same time without constantly running multiple queries.

For example, something similar to one person having a query running on a VNC server with a number of clients connecting. Or even if there was a static chart that is periodically (~5-20 seconds) updated to reflect what is happening on the real-time chart?

Is this kind of thing possible? We want to, where possible, limit the amount of queries being run on the server, but we want everyone in the support team to be able to be able to see this at the same time.

Thanks in advance!

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

One way to achieve this is to schedule the real-time search, then everyone opening a dashboard using that saved search should hook into the already running job.

In the Web Framework a SearchManager has a property cache that let's you fine-tune this behaviour - even without a scheduled search. Didn't test this for real-time searches yet though.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

One way to achieve this is to schedule the real-time search, then everyone opening a dashboard using that saved search should hook into the already running job.

In the Web Framework a SearchManager has a property cache that let's you fine-tune this behaviour - even without a scheduled search. Didn't test this for real-time searches yet though.

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...