Searches & Reports

[itsomana]

I have configured a dashboard with 28 boxes which change from green to red depending on the parameters of the saved search. The dashboard is configured to refresh every three minutes.

The saved searches relating to the 28 boxes are configured with a time range of of -5m to now. Half a dozen of these are scheduled to run every five minutes. If an event occurs as outlined in the saved search Spunk will then email certain individuals.

I am trying to establish if there would be too much overhead on the splunk server by configuring the saved searches and reports this way?

[kdenton]

That's a hard question to answer as it really depends on what other searches are taking taking up resources at the time.

Here is an article I used when I did something similar for a client.

http://www.splunk.com/wiki/Community:SplunkTuningFactors

I found to spread my data into separate indexes as well as use some summary indexing helped a lot to speed things up.

Bottom line, is you will need to try it and see how things go, but keep in mind that when those searches are running every 5 minutes this also takes resources.