I've got a dashboard in which the panels depend on accelerated reports. When building these reports, I've let them run once on 00:00 using scheduling. The next couple of days, these dashboards are extremely fast. However, I have to turn of scheduling because I want users to be able to use a time picker in my dashboard. After a couple of days, my dashboard panels have to be loaded all over again when an user wants to see the dashboard. Because the underlaying data consists of approx 10M events, this takes about half an hour.
From what I read on Splunk Answers and Splunk Docs, accelerated reports are filled every 10 minutes. My report acceleration summary page, however, shows for all of my reports that the summary is not updated for the last 8 days, when I ran the complete search for the last time.
What I want, is users to be able to use a time-picker on my dashboards and have results displayed immediately after they make their selection, just like the dashboard would behave just after running the report manually. Does anybody know how to achieve this?
Thank you very much in advance!
↧
