topic Re: Searches for hidden graphes are run in Splunk Dev

Searches for hidden graphes are run

pduflot — Fri, 18 Mar 2016 11:00:13 GMT

Hello,

I have a dashboard where some graphes are hidden because they depend on a token that is not defined.
However, it seems that the searches that populate those graphes are still run. I see this because the number of access to the accelerated reports increased.
Can somebody confirm? If yes, How is it possible to prevent those searches to run? It slows down the display of the dashboard.

Basically I have:
2 base searches:
- NormalSearch
- ExtendedSearch

When the user goes to extended mode. All normal graphes are hidden and all extended graphes are shown.

Thanks!

Re: Searches for hidden graphes are run

woodcock — Mon, 21 Mar 2016 01:02:17 GMT

Add a do-nothing reference to one of the tokens into each of the searches that do not have them. You can do this by postpending this to every search:

... | rename CommandPreventsThisSearchFromAutoRunningBeforeTokensAreSet AS $SomeToken$

Re: Searches for hidden graphes are run

pduflot — Mon, 21 Mar 2016 16:57:24 GMT

Nice trick. Works well, thanks!