Manage dashboard resource consumption
Manage dashboard resource usage by deactivating problematic dashboards and controlling access to auto-refresh searches based on user roles and capabilities.
Managing dashboard resource consumption is crucial to ensuring system stability, optimal performance, and cost-efficiency. As a Splunk administrator, you can manage dashboard resource consumption in the following ways:
-
Deactivating dashboards. When you deactivate a dashboard, users cannot access it via the UI. For example, you may want to deactivate a problematic or resource-intensive dashboard, resolve the dashboard's underlying issue, then reactivate it. Deactivating a dashboard allows you to put the dashboard is in a state that prevents further misuse and resource consumption.
-
Controlling access to auto-refresh searches. You can limit access to auto-refresh searches to certain user roles to reduce resource consumption. For users without access to auto-refresh searches, searches run only upon initial dashboard load and manual refreshes.
Deactivating dashboards
To deactivate dashboards, you must have the deactivate_dashboards capability, which the admin and sc_admin roles have by default. Users with the admin and sc_admin roles can assign the capability to other user roles.
You can only deactivate Dashboard Studio and Simple Classic XML dashboards.
-
Go to Settings > User interface > Views.
-
Find the desired dashboard. Dashboards are listed by their dashboard ID. In the Status column, click Disable.
-
To reactivate the dashboard, click Enable. The dashboard appears in the UI again.
Controlling access to auto-refresh searches
You can limit access to auto-refresh searches to certain user roles to reduce resource consumption.
-
For users with the auto_refresh_dashboards capability, searches automatically refresh per their configured refresh schedule.
-
For users without the auto_refresh_dashboards capability, searches run on initial load and on manual refreshes. Searches do not auto refresh per their configured refresh schedule.
The admin and sc_admin roles have the auto_refresh_dashboards capability by default. Users with the admin and sc_admin roles can assign the capability to other user roles.
Scheduled saved searches and real-time searches refresh regardless of whether the user has the auto_refresh_dashboards capability or not.
The following shows an example of when a user without the auto_refresh_dashboards capability views a dashboard with an auto-refresh search scheduled to refresh every 5 seconds. When the user first opens the dashboard, a warning displays that they do not have the required capability to use auto-refresh. The search runs on initial load and populates the table, but does not auto refresh. Results stay static unless the user manually refreshes the search or modifies the dashboard.
The following shows an example of when a user with the auto_refresh_dashboards capability views the same dashboard. The search runs on initial load and populates the table, then refreshes every 5 seconds per the refresh schedule.
When the search refreshes, an icon appears in the upper right corner of the visualization before it displays the refreshed results.