Splunk Search

Real-time charts - Query once, view many?

alekksi
Communicator

Hi all,

We have a splunk setup where we are investigating a way of having a shared streaming dashboard that can be used by multiple people at the same time without constantly running multiple queries.

For example, something similar to one person having a query running on a VNC server with a number of clients connecting. Or even if there was a static chart that is periodically (~5-20 seconds) updated to reflect what is happening on the real-time chart?

Is this kind of thing possible? We want to, where possible, limit the amount of queries being run on the server, but we want everyone in the support team to be able to be able to see this at the same time.

Thanks in advance!

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

One way to achieve this is to schedule the real-time search, then everyone opening a dashboard using that saved search should hook into the already running job.

In the Web Framework a SearchManager has a property cache that let's you fine-tune this behaviour - even without a scheduled search. Didn't test this for real-time searches yet though.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

One way to achieve this is to schedule the real-time search, then everyone opening a dashboard using that saved search should hook into the already running job.

In the Web Framework a SearchManager has a property cache that let's you fine-tune this behaviour - even without a scheduled search. Didn't test this for real-time searches yet though.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...