Real-time charts - Query once, view many?

[alekksi]

Hi all,

We have a splunk setup where we are investigating a way of having a shared streaming dashboard that can be used by multiple people at the same time without constantly running multiple queries.

For example, something similar to one person having a query running on a VNC server with a number of clients connecting. Or even if there was a static chart that is periodically (~5-20 seconds) updated to reflect what is happening on the real-time chart?

Is this kind of thing possible? We want to, where possible, limit the amount of queries being run on the server, but we want everyone in the support team to be able to be able to see this at the same time.

Thanks in advance!

[martin_mueller · Accepted solution]

One way to achieve this is to schedule the real-time search, then everyone opening a dashboard using that saved search should hook into the already running job.

In the Web Framework a SearchManager has a property cache that let's you fine-tune this behaviour - even without a scheduled search. Didn't test this for real-time searches yet though.