reuse real time searches

[gcusello]

Hi at all,
I have a situation where there are around 10 users that need to use for their job two o three dashboards containing each one 8-12 panels with real time searches.

This is a problem because I have not many logs (around 15-20 GBs/day) but I need very many resources to answer to the request (three indexers with 12 CPS each one aren't sufficiet to answer to the requests).

Is it possible, having realtime searches, to run them once and every user use results?

Bye.
Giuseppe

[richgalloway · Accepted solution]

Do you really need real-time searches? If only people will be reacting to the search results then real-time is probably not a necessary waste of resources. Consider switching them to scheduled searches running every minute or two. Then each dashboard can reuse the results of the scheduled searches.

[gcusello]

Finally customer accepted to schedule searches instead use Real Time Searches!
Thank you.
Bye.
Giuseppe