Dashboards & Visualizations

How to quickly update transaction count on a dashboard?

randymoore
Explorer

Hello everyone,

We have a dashboard that displays the number of transactions for the day, as a single value panel. The search is very simple and easy as each transaction is a separate event in the log:

index=my_index category=transaction | stats count

The dashboard refreshes every 5 minutes. Which means that Splunk recounts them every 5 minutes to come up with the new count. What happens is that during our busy time of the year, the number of transactions arriving exceed 5 minute refresh time it takes Splunk to finish counting them.

What I would love is for Splunk to “remember” the last count of transactions (say it was 7,500,000) and start counting from there. That way, the count is accurate, and the Splunk processing is not as great (hopefully).

I just don’t know how to do that, or if it can be done. Any ideas?

0 Karma
1 Solution

sundareshr
Legend

nravichandran
Communicator

One of the option could be to use KV Store to Persist data, but for that particular session.

0 Karma

randymoore
Explorer

Looking into that next. Will update by the begining of next week hopefully.

0 Karma

sundareshr
Legend

Have you looked at Accelerated Reports?

randymoore
Explorer

Thanks for the pointer to Accelerated Reports. I enabled that for the dashboard panel. I'll time it over the next few days to see if it works as I expect.

0 Karma

randymoore
Explorer

Ran a stress test and using Accelerated Reports worked like I wanted it to. Thanks!

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...