Book Image

Implementing Splunk (Update)

Book Image

Implementing Splunk (Update)

Overview of this book

Table of Contents (20 chapters)
Implementing Splunk Second Edition
Credits
About the Authors
About the Reviewers
www.PacktPub.com
Preface
Index

Scheduling the generation of dashboards


As we stepped through the wizard interface to create panels, we accepted the default value of running the search each time the dashboard loads. As we mentioned earlier, this means that the user is penalized each and every time the dashboard is loaded in their web browser. It is silly (and a waste of resources) to rerun perhaps multiple searches that are within a dashboard panel if the data, that the search is based upon, does not change often. For example, if the indexed data is updated every evening, then re-running a search on that data multiple times within the same day will not yield different results and would be a waste of resources.

A more prudent approach would be to convert the dashboard panels to not use inline, real-time searches but reference reports instead (earlier in this chapter, we covered Convert to Report) or to use scheduled-queries.

If we use reports or scheduled-queries in our dashboard, when the dashboard is loaded, the results...