I created a dashboard including a realtime timechart. My real time search <module name="HiddenSearch" autoRun="True"> <param name="search">index="foo" sourcetype="foo" | timechart span=5m count as PV</param> <param name="earliest">rt-24h</param> <param name="latest">rt</param> <module name="EnablePreview"> <param name="enable">true</param> <param name="display">false</param> <module name="HiddenChartFormatter"> <param name="chart">line</param> <param name="primaryAxisTitle.text">Time</param> <param name="chart.stackMode">default</param> <param name="secondaryAxisTitle.text">Count</param> <module name="FlashChart"> <param name="width">100%</param> <param name="height">250px</param> </module> <module name="ViewRedirectorLink"> <param name="viewTarget">flashtimeline</param> <param name="label">View results</param> </module> </module> </module> </module> Because the data crosses 24h and is big, every time I open the dashboard, the chart will reload completely. That will take a long long long time to finish. My question is whether the realtime search result can be saved so that I can view the report immediately if I open the dashboard? ... View more

Does more indexers contribute to the performance of search on search head? I found when i launch a search in the search head, every time there is only one indexer in my indexers group running . And the event scanning speed is not faster than all the things done within a single splunk instance. I wonder if the more indexers there are, the faster search speed it is? ... View more

If I launch a search in search head, can I make it possible to let each distributed search job in every indexer run on muilti cpu cores? Since my indexer has 24 cores, so only one cpu doing the job is really slow! My splunk version is 4.3. ... View more

Can I add the map view to dashboard? ... View more

My deployment is: 1 Forwarder + 2 Indexers + 1 Search head. The two indexers contains about 50GB(about 100,000,000 events) indexed data(load balanced). Once I launch a search "sourcetype=xxx" from search head to get all the results, I found only one of my indexers perform the search job while the other indexer keeps still. It is really confusing....Why? ... View more

My deployment is: 1 forwarder + 2 indexers + 1 search head. The forwarder has forwarded 50GB(about 100,000,000 events) to the two indexers; When I launch a search like "sourcetype=xxx" from search head, I find the search performance really quite disappointing. Only 10,000 events can be scanned per second! That's to say, it will take about 3 hours to finish scaning all the events! Each of my indexers has 24 cpus. And each time I launch a search from search head, only one cpu in each indexer is running about 100% while others keep free. It seems that one search job only works on one thread. That's quite a waste of my indexer' computing ability! Are there any ways to config splunk to solve this problem? ... View more