Which do you recommend from a OS and search performance perspective and for realtime searches in a dashboard (or close to real time)?
if you use the same inline search on several dashboard, they will have to run several time in parallel.
while using a saved search can run it a single one and use the same results for all the dashboards.
other than that, there is not difference between saved and inline.
in general, do not do real time except if you have no other choice (they impact memory, inodes, indexing speed)
thanks bro for your answer .. it really cleared my doubts... 🙂