We're thinking of building a monitoring console for the NOC team using Splunk. If I want to display three real-time charts on a dashboard, what is the best way to do so while minimizing the number of CPU cores in use? Is it better to do one search per chart? Or is it more efficient to run a search in the background and drive each chart with a subsearch of that data?
asked 07 May '12, 22:52