topic Re: How do you control look ups in a multi-panel dashboard? in Dashboards & Visualizations

How do you control look ups in a multi-panel dashboard?

sarge338 — Wed, 03 Apr 2019 18:08:11 GMT

Hello

I have a regular report that I have to provide to a customer, and we are utilizing Splunk as the mechanism to retrieve the data from the source. The dataset is too large to pull down and process locally, so I have several different look-ups written to pull specific data views for the report. However, since we are connecting to an external database to pull the data, I would like to limit the "hit" that database takes at one time.

With that said, is there a way to "control" how Splunk executes panel look ups? For instance, panel 1 executes immediately. After panel one contains data, panel 2 executes. After panel 2 contains data, panel 3 executes. And so on...

I have seen one strategy that basically has sub-searches off of one master search's data, but again, that data set would be so big, I don't know that a master search would even complete. Hence, I am looking for other options. Otherwise, I will continue to have to run individual look ups manually, which is not efficient.

Thank you.

Re: How do you control look ups in a multi-panel dashboard?

niketn — Wed, 03 Apr 2019 18:23:48 GMT

@sarge338 refer to one of my answers which runs the searches one at a time only after previous one completes.

https://answers.splunk.com/answers/683826/how-do-you-set-the-order-of-queries-to-be-run-in-a.html

Re: How do you control look ups in a multi-panel dashboard?

sarge338 — Wed, 03 Apr 2019 19:06:40 GMT

@niketnilay that looks JUST like what I'm looking for! I'll give that a shot, and let you know how it goes!

Thanks!!

Re: How do you control look ups in a multi-panel dashboard?

sarge338 — Mon, 06 May 2019 13:37:33 GMT

That worked beautifully! Now my entire dashboard can populate without straining the database.

Thanks!!