How to keep everyday search result on dashboard?
e.g. I need a search to run daily on 00:01 Hours everyday and display it on dashboard, but when it runs on the next day, it should produce a column with the current date and keep the column of the previous date result as well. I would like this dashboard to maintain the search result history for the last 1 month.
Any Ideas, how to do that?
Try summary indexing. Run your search everyday and store only the results you want in summary index. Use the summary index in dashboard. This will speed up your dashboard especially if you have to search for one month data
http://docs.splunk.com/Documentation/Splunk/6.3.1511/Knowledge/Usesummaryindexing
You could use the Timewrap command: https://splunkbase.splunk.com/app/1645/
| timechart count span=1h | timewrap d |
It allows you to compare days to days or weeks to weeks very easily
Try summary indexing. Run your search everyday and store only the results you want in summary index. Use the summary index in dashboard. This will speed up your dashboard especially if you have to search for one month data
http://docs.splunk.com/Documentation/Splunk/6.3.1511/Knowledge/Usesummaryindexing
If your number of results are less then,
your search query.... | append [|inputlookup RESULTS.csv | eval epoch_date=strptime(date,"%Y-%m-%d") (or whatever the format) | where epoch_date>=now-(30*86400) ]outputlookup RESULTS.csv
Now schedule this search to run at 00:01 hours everyday and use the RESULTS.csv to power your dashboard.
P.S: Accept the answer if it is useful.