Hi
I want to reduce the search load on Splunk machine each time the user views a dashboard. Can we have a report run weekly say every sunday midnight? Which will save the report for the past week. The user will be able to view only last weeks report in the current week.
Is this possible with splunk? If yes, please tell how to.
Thanks Viv
Yes, it is possible.
But if your search performs data aggregation (timechart, stats, chart,...) you might want to use summary indexing instead... Which kind of search is that?
To re-use a search results in a dashboard you basically have to:
Yes, it is possible.
But if your search performs data aggregation (timechart, stats, chart,...) you might want to use summary indexing instead... Which kind of search is that?
To re-use a search results in a dashboard you basically have to:
Hi,
Is this functionality also available in Simple XML Dashboards?
You're welcome!
Hey Paolo
Thanks for the detailed steps.
I could configure it on our splunk.
Resolved our issue, I appreciate your help.