Splunk Search

Real-time charts - Query once, view many?

alekksi
Communicator

Hi all,

We have a splunk setup where we are investigating a way of having a shared streaming dashboard that can be used by multiple people at the same time without constantly running multiple queries.

For example, something similar to one person having a query running on a VNC server with a number of clients connecting. Or even if there was a static chart that is periodically (~5-20 seconds) updated to reflect what is happening on the real-time chart?

Is this kind of thing possible? We want to, where possible, limit the amount of queries being run on the server, but we want everyone in the support team to be able to be able to see this at the same time.

Thanks in advance!

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

One way to achieve this is to schedule the real-time search, then everyone opening a dashboard using that saved search should hook into the already running job.

In the Web Framework a SearchManager has a property cache that let's you fine-tune this behaviour - even without a scheduled search. Didn't test this for real-time searches yet though.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

One way to achieve this is to schedule the real-time search, then everyone opening a dashboard using that saved search should hook into the already running job.

In the Web Framework a SearchManager has a property cache that let's you fine-tune this behaviour - even without a scheduled search. Didn't test this for real-time searches yet though.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...