Getting Data In

Base Searches for Dashboards using Splunk Metrics

splunkninga2
New Member

Hi all,

My team recently got metric data into Splunk and I created several dashboards with various drop down tokens for metric names as well as host. My next step was to try and create a logical base search with post processing searches to reduce the amount of concurrent searches running within the panels. I've been having a heck of a time getting a proper base search to work when it struck me:

These metric searches on the panels almost always complete in 1 second and there aren't too many metric points being generated per day. Are base searches even worth it for this type of data? I know that base searches is a best practice for dashboards, but these panels still load almost instantly even when concurrent dashboards are being run. Trying to get some potential insight before I go down rabbit holes again to get a base search and post processing searches to work.

Appreciate any feedback 😄

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...