topic Re: dynamic form... is it normal to be this slow? in Dashboards & Visualizations

dynamic form... is it normal to be this slow?

mikefoti — Tue, 08 May 2012 12:36:24 GMT

A simple query runs very quickly (3s)... but when I use that same query to build a dynamic form (either radio or dropdown) the query takes apporx 60s. As a test I have eliminated charts so the form only creates a dropdown list (or radio buttons) plus a row of static HTML (becuase apparently I must have a childobject within the form). But it still takes approx 60s.

My question is... is this normal.. or is there soemthing wrong with my simple XML?

    <form>
<label>Test InvertedFlow 5</label>
<fieldset autoRun="true">
<input type="radio" token="ip">
<label>Select Store IP</label>
<populatingSearch fieldForValue="nps_radiusClientIP" fieldForLabel="nps_radiusClientIP">
<![CDATA[index=winradius eventtype=nps_accessReqRejected | top nps_radiusClientIP]]>
</populatingSearch>
<earliestTime>-4h</earliestTime>
<latestTime>now</latestTime>
</input>

<input type="time">
<default>Last 4 Hours</default>
</input>
</fieldset>

<row>
<html>
<p>This is an <i><b>HTML panel</b></i> providing links to saved searches.</p>
</html>
</row>
</form>

Re: dynamic form... is it normal to be this slow?

mikefoti — Thu, 28 Jun 2012 14:08:50 GMT

Through trial and error I discovered, when possible/practicable, replacing the dynamically populated lookup (where list items are generated from query results) with a static lookup (where list items are coded within the xml) is much quicker. In hind site this seems kind of obvious. Whether trying to populate a list of radio buttons or a drop-down list, it will take longer if splunk has to query an index vs simply pulling list items right out of the xml it is already reading.

More info on how to replace a dynamically populated drop-down with a static drop-down here
http://splunk-base.splunk.com/answers/51663/convert-dynamic-drop-down-to-static-in-advanced-xml

Re: dynamic form... is it normal to be this slow?

lguinn2 — Fri, 09 Nov 2012 23:06:52 GMT

index=winradius eventtype=nps_accessReqRejected | top nps_radiusClientIP

runs over all time. change it to

index=winradius eventtype=nps_accessReqRejected earliest=-24h | top nps_radiusClientIP

and I'll bet it runs much much faster...