Reporting

What are some of the best practices for scheduled searches?

yanlajeunesse
Explorer

Hello,

I'm still very new to Splunk.

I have a dashboard with a search, and users can choose between the last 24 hours, the last 30 days, the last 90 days, or the last year.
For the last 24 hours, it should never get too slow, and to let users the 'freshest' data, I leave it as an inline search. However, for the longer searches, users are mainly looking at trends, and so I thought the best way to speed everything up would be with a scheduled search that runs say, once a day.
This works absolutely fine, but I don't want to make a scheduled search for 30 days, another scheduled search for 90 days and yet another for a year. I assume there's a way to simply scheduled a search for a year to run everyday, and for the smaller time ranges i could just pick my results from it. I've been searching a lot about datasets, data models, scheduled searches but I can't quite find the best way to do this.

Thank you!

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

IMO, setting up accelerated data models would be the recommended approach where it generate the trend data/statistics you want for specified period and it's self-repairing (for gaps). See this for more information on the that.
http://docs.splunk.com/Documentation/Splunk/7.0.0/Knowledge/Acceleratedatamodels

Another option is to setup summary indexing (say daily generate the reporting data) for your data and use summary index for your dashboard. See this for more information.http://docs.splunk.com/Documentation/Splunk/6.6.3/Knowledge/Usesummaryindexing

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

IMO, setting up accelerated data models would be the recommended approach where it generate the trend data/statistics you want for specified period and it's self-repairing (for gaps). See this for more information on the that.
http://docs.splunk.com/Documentation/Splunk/7.0.0/Knowledge/Acceleratedatamodels

Another option is to setup summary indexing (say daily generate the reporting data) for your data and use summary index for your dashboard. See this for more information.http://docs.splunk.com/Documentation/Splunk/6.6.3/Knowledge/Usesummaryindexing

yanlajeunesse
Explorer

Thank you! I don't know how to accept this as an answer, but it is what I need, I will dive into data models as it seems the most appropriate for my issue.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

I converted @someson2's comment to an answer. Feel free to accept it 🙂

skoelpin
SplunkTrust
SplunkTrust

Yep, I second @somesoni2 about the accelerated data models. Depending on how large your summary range is will depend on how much disk space you use (Be careful with selecting ALL-TIME).

I prefer data models over summary indexes but there's some cases where it makes sense.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...