I have a very slow search that I would like to schedule and save the results in a dashboard so the search doesn't have to rerun. The search is extremely slow because it uses transaction
across hundreds of thousands of log events.
What I would like to have is a search that runs once every 24 hours, saves the results from the job to a dashboard.
sourcetype="cisco:esa:textmail"
| transaction mid
| search reason="content filter:Auto_Notify"
| table mid, sender, recipient, file_name, attachment_type, subject, quarantine_dest, vendor_action, reason
This seems like a prime case for summary indexing. Run this search every so often, save the results to a summary index, use the summary index on your dashboard.