×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
martinb
Loves-to-Learn
Member since: ‎08-20-2025
‎09-14-2025
Community Statistics
Posts 3
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎2025-08-20
View All

Re: Best Way to Maintain Live Order Status Without...

by in Knowledge Management
‎09-14-2025 02:28 PM
‎09-14-2025 02:28 PM
Thanks for your reply!  What is the best alternative to using joins?  I think I could get away with up to 5 minutes delay, but less is better - as the dashboard is highlighting when orders are delayed so that users can intervene early and find the reason for the delay. What if I ran a summary index every 5 minutes to only identify the orderID of the orders that are still open, and then running a base search to get the details in the dashboard for the ones that aren't - that way instead of running the search on every order that happened in the last x hours, we only run the search on the ones that aren't finished? ... View more

Re: Best Way to Maintain Live Order Status Without...

by in Knowledge Management
‎09-14-2025 02:24 PM
‎09-14-2025 02:24 PM
By Live I meant more that the dashboard is used for monitoring, so needs up to date information on the order status, if there is a delay of more than around 5 minutes then they require intervention - so running a report every 10 minutes wouldn't work in this instance.   But also yes, they are running searches each time the dashboard is refreshed. I've managed to limit the number of users to only 1 or 2 at this stage, which is why I'm trying to optimize this now rather than letting it become a problem for later. ... View more

Best Way to Maintain Live Order Status Without Exp...

by in Knowledge Management
‎09-13-2025 06:36 PM
‎09-13-2025 06:36 PM
Hi all, I'm new to Splunk and have been thrown in at the deep end, so apologies if this is the wrong place or a basic question. We have a dashboard that tracks the status of orders (Started, Completed, Cancelled, etc.) coming from different source types and highlights red if it hasn't updated in some time. Right now, it runs multiple heavy searches with a lot of joins on OrderID to show if an order is running late. Since this dashboard is live and viewed by many people, performance is a concern. What I'm looking for is a way to maintain a kind of “live” or frequently updated table (keyed by OrderID) that stores the latest status values (Started, Completed, Cancelled, etc.) and maybe a calculated (on-time, late etc,) so that dashboards or other searches don’t have to recompute everything each time. Is there a recommended approach for this in Splunk? Summary indexing, KV store, or something else? Thanks in advance! Note: I'm using Splunk Enterprise 8.2 ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎09-14-2025 02:21 PM