As Damien mentioned, summary indexing can help, but may not be enough. Also, it's possible to run scheduled searches and save the results of said scheduled searches for use within dashboards (as opposed to running the search at dashboard load time) However, if response time is paramount, I would highly recommend applying more hardware to your situation. Splunk's search response time is very I/O dependent, and the horizontal scaling of distributed search is designed to help distribute that I/O across many disks in many machines. Erik Swan's blog post http://blogs.splunk.com/2009/10/27/add-a-server-or-two/ discusses this exact issue. If upper management doesn't have the time to wait a couple of minutes for a dashboard to display, then they should be willing to fund the extra hardware needed to speed your deployment up to their satisfaction. ... View more

You should be able to use the span=1w directive for timechart . For example: ... | timechart span=1w count . If this doesn't do it, you can tune the chart properties if you put the chart on a dashboard. See http://www.splunk.com/base/Documentation/latest/Developer/ChartReference as a reference. ... View more

What about higher versions - say 6.4.5 ... View more