The saved search is stored as:
[average page response time - 4 hours]
action.email.useNSSubject = 1
alert.track = 0
dispatch.earliest_time = -4h@m
dispatch.latest_time = now
dispatchAs = user
display.events.fields = ["host","source","sourcetype","debug","field_4","app_id","page_id","time_taken","time_to_first_byte"]
display.general.type = visualizations
display.page.search.tab = visualizations
display.statistics.show = 0
display.visualizations.charting.chart = line
display.visualizations.singlevalue.numberPrecision = 0.000
display.visualizations.singlevalue.unit = s
display.visualizations.type = singlevalue
request.ui_dispatch_app = search
request.ui_dispatch_view = search
search = source="/var/log/httpd/REDACTED_log" (page_id=* OR ref_page_id=*) | eval time_in_s=time_taken/1000000 | timechart avg(time_in_s)
time_taken is from the Apache logs and is the time taken in microseconds.
The report is simply embedded into the dashboard XML:
<panel>
<single>
<title>average page response time - 4 hours</title>
<search ref="average page response time - 4 hours"></search>
</single>
</panel>
... View more