Splunk Best Practices

Summary

In this chapter, we have discussed how to create form-based dashboards leveraging $foo$ variables as selectors to appropriately pass information to another search, or another dashboard; also, we have seen how to create an effective drilldown effect. In the next chapter, we will see how to optimize dashboards to increase performance. This ultimately affects how quickly dashboards load results. To do this, we can adjust search queries, leverage summary indexes, the KV store, accelerated searches, and data models to name a few.