The panels start to increase the efficiency of Splunk's visualizations considerably, and the reason is quite simple. A scheduled report is held in cache memory, and that data can then be referenced by search panels in order to streamline your user experience. A report is little more than a saved search that is scheduled to run at specific intervals; because that report continues to refresh its result set, the panels that reference that data can display those results that much faster.

I will be referencing the examples used in the Splunk 6.x Dashboard Examples, so for future referencing please feel free to check out that app.

Let's use our same dashboard example to explore how this will work. I am going to ask you to use your imagination a bit for this one in order to understand the technique.

Let's say for a moment that, in our Splunk instance, our Netscaler is doing Gbps worth of throughput and it is taking a very long time to generate the chart from the first panel...