In this case you might be happy to have the dashboard take a few extra seconds to load if it results in less searches being executed. This could be important in large distributed environments with a large number of concurrent users. One other thing to note here is that, if the dashboard is very heavily used and you can have base searches to reduce the number of searches that run when the dashboard loads (or alternatively have panels behind check boxes etc.) then you could reduce your concurrent search load on your Splunk servers. single value visualizations) and avoid base searches when you want to display more non aggregated events (e.g. ![]() In general I've found the best approach is to use base searches for summary panels at the top of dashboards which use aggregated data (e.g. Learn about the available search types and how to work with them in Simple XML. You can also use searches to implement dynamic or interactive behavior in a dashboard. This can in turn lead to a lot of queuing for the users search jobs so it's worth noting how much disk space base searches use via the job inspector or the _introspection logs when developing the dashboard. Download topic as PDF Searches power dashboards and forms Searches generate visualizations and other content in dashboards and forms. In addition, they also use a large amount of disk space which contributes to the users disk quota (until the search artifacts are removed). ![]() I find base searches which are too generic and return a large number of non aggregate events perform very poorly. ![]() My experience is very much the same as this.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |