https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-efficient-and-fast-searches-reports-and-dashboards/m-p/302878#M19305 <P>How to make efficient and fast searches ,reports and dashboards?</P> Wed, 21 Feb 2018 11:26:06 GMT abhi04 2018-02-21T11:26:06Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-efficient-and-fast-searches-reports-and-dashboards/m-p/302878#M19305 <P>How to make efficient and fast searches ,reports and dashboards?</P> Wed, 21 Feb 2018 11:26:06 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-efficient-and-fast-searches-reports-and-dashboards/m-p/302878#M19305 abhi04 2018-02-21T11:26:06Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-efficient-and-fast-searches-reports-and-dashboards/m-p/302879#M19306 <P>Below is what I usually think.</P> <P>・Reduce number with base search<BR /> ・Specify the time range. As narrow as possible<BR /> ・Be sure to specify the index<BR /> ・Do not use wildcard search.<BR /> 　　　XXX*⇒ If you can not stand it<BR /> 　　　<EM>XXX⇒ NG<BR /> 　　　*XXX</EM>⇒ NG<BR /> ・Do not use NOT (!=)<BR /> ・Transaction / join-sub search Do not use .Use stats command.<BR /> ・Reduce the field used by the fields command early.</P> Tue, 29 Sep 2020 18:09:03 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-efficient-and-fast-searches-reports-and-dashboards/m-p/302879#M19306 HiroshiSatoh 2020-09-29T18:09:03Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-efficient-and-fast-searches-reports-and-dashboards/m-p/302880#M19307 <P>@abhi04, there could be so many things to consider. Could you state what you are doing right now that needs optimization so that we could be more specific?</P> <P>Just to add on to @HitoshiSatoh 's points here are the Splunk Documentations for you to read/understand and implement:</P> <P>1) Post Processing Best Practice: <A href="http://docs.splunk.com/Documentation/SplunkCloud/latest/Viz/Savedsearches#Best_practices">http://docs.splunk.com/Documentation/SplunkCloud/latest/Viz/Savedsearches#Best_practices</A><BR /> 2) Quick Tips for Search Query Optimization: <A href="https://docs.splunk.com/Documentation/Splunk/latest/Search/Quicktipsforoptimization">https://docs.splunk.com/Documentation/Splunk/latest/Search/Quicktipsforoptimization</A><BR /> 3) Optimize your lookup search: <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup#Optimizing_your_lookup_search">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup#Optimizing_your_lookup_search</A><BR /> 4) Event Correlation method consideration: <A href="http://docs.splunk.com/Documentation/Splunk/latest/Search/Abouteventcorrelation">http://docs.splunk.com/Documentation/Splunk/latest/Search/Abouteventcorrelation</A><BR /> 5) Use of multisearch to overcome subsearch limitation: <A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Multisearch#Subsearch_processing_and_limitations">https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Multisearch#Subsearch_processing_and_limitations</A><BR /> 6) Use Knowledge Objects for easier maintenance and re-usability of code: <A href="http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/WhatisSplunkknowledge">http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/WhatisSplunkknowledge</A><BR /> 7) Use of Data Summary for accelerated Search: <A href="http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Aboutsummaryindexing">http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Aboutsummaryindexing</A> </P> Wed, 21 Feb 2018 15:16:34 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-efficient-and-fast-searches-reports-and-dashboards/m-p/302880#M19307 niketn 2018-02-21T15:16:34Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-efficient-and-fast-searches-reports-and-dashboards/m-p/302881#M19308 <P>@niketnilay</P> <P>Great content. Thanks for sharing this!</P> Wed, 21 Feb 2018 15:21:55 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-efficient-and-fast-searches-reports-and-dashboards/m-p/302881#M19308 albinortiz 2018-02-21T15:21:55Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-efficient-and-fast-searches-reports-and-dashboards/m-p/302882#M19309 <P>Hi niketnilay,</P> <P>I asked in a general way and not specific. Thanks for sharing this information,this helps.</P> Wed, 21 Feb 2018 18:00:37 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-efficient-and-fast-searches-reports-and-dashboards/m-p/302882#M19309 abhi04 2018-02-21T18:00:37Z