Hi. We are trying to create a dashboard in which all the panels use the same information about the current (real time) events being logged in a file for the last 30 minutes. I want to use a element as I understand real time searches are CPU-expensive, so the main idea would be to get the data once in a real time search and keep passing the data to the elements to filter and reorganize different views of the same flow of events. However, I don't know how to make it work. I've created the search template with the search clause, added the and elements but the panels with searchPostProcess elements either didn't receive data or keep waiting for data. I tried to set the search template withpur any time restriction but the search goes for all the events since the very beginning in the index, clearly that's not what we want as is more expensive and at the end such amount of information is not useful for what we want. Is there a way to optimize the dashboard in this way, real-time searching only one time and passing the events to search postprocesses? Or the only option is to declare the whole real-time statement in every single panel. I think the second would be more demanding for the server as it would start several real-time searches over the same index at once. Thanks for any help Arturo. ... View more

Hi. I want to create a Dashboard containing several widgets that mainly, are views of the same set of information regarding activity of users in a system. The widgets will show the information about activity but splitted by different fields, summarized by different criteria or just grouped in many ways. Basically I want to reuse the same initial search and let every widget add specific constraints to the search or add stats, chart or formatting commands. Is that possible? *I'm using Splunk 6.1 ... View more