topic Re: help on post process search in Splunk Enterprise

help on post process search

jip31 — Mon, 17 Jan 2022 06:26:30 GMT

hello

I use a dashboard with different post process search because I reuse the same index and the same sourcetype

<search id="erreur"> <query>index=toto` sourcetype=tutu:web:error site=$site$ | fields web_error_count </query> <earliest>$date.earliest$</earliest> <latest>$date.latest$</latest> </search>

<search base="erreur"> <query>| stats sum(web_error_count) as web_error_count | appendpipe [ stats count as _events | where _events = 0 | eval web_errr_count = 0 ]</query>

But sometimes I need to use the same index and the same sourcetype only one time

So, in this case I use an inline search in the dashboard

What I need to know is about the performances

Is it better to use a post process search or an inline search when we dont have to reuse a specific sourcetype?

And when I have 2 inline search with the same index and 2 different sourcetype, is it better to use a post proces search like this

<search id="test"> <query>index=toto` sourcetype=tutu:web:error OR sourcetype=titi:url) site=$site$ | fields web_error_count </query> <earliest>$date.earliest$</earliest> <latest>$date.latest$</latest> </search>

Thanks

Re: help on post process search

ITWhisperer — Mon, 17 Jan 2022 07:02:42 GMT

It depends on your data - use the job inspector to see how your searches perform doing it different ways and choose the best way for you.

Having said that, there are a couple of techniques you could use which may help. You could schedule reports to run and reference the results in your dashboard. You could store the search id of the base searches and use loadjob to retrieve the results in other searches.

Re: help on post process search

jip31 — Mon, 17 Jan 2022 07:21:35 GMT

thanks

I know for scheduled reports but it is not what I need because I need to have the last results when I open the dashboard

So i am going to compare performances with the job inspector

Re: help on post process search

isoutamo — Mon, 17 Jan 2022 07:22:18 GMT

You must also remember that with base searches you should use transforming command on base search or otherwise there is a big risk that your result set is too big (500k) and it ignore some results. You could found more here Use a transforming base search.

IMHO: if you have only one search then I prefer to use it as inline. It's much easier handle that way and there is not that previous limitation.

r. Ismo