topic Is there a better way to do a dashboard using same database input for multiple panels? in Dashboards & Visualizations

Is there a better way to do a dashboard using same database input for multiple panels?

dirtebird — Thu, 11 Aug 2022 17:48:55 GMT

I'm creating a new dashboard using an existing database input. This dashboard will have multiple (7+) panels searching the same database input, with the same filtering criteria, but different grouping and aggregating. I was wondering if there is a better way to do this? Does this cause 7+ separate reads to the same DBInput when it could be accomplished in one? Thanks!

Re: Is there a better way to do a dashboard using same database input for multiple panels?

richgalloway — Thu, 11 Aug 2022 18:00:23 GMT

By default, each search in a dashboard runs independently. That means 7 panels using the dbxquery command will generate 7 reads against the database.

The way to avoid that is with what's called "post-processing". In post-processing, a base search makes the query against the database (or index) and later queries further process the results (grouping and aggregating).

See https://docs.splunk.com/Documentation/Splunk/9.0.0/Viz/Savedsearches#Post-process_searches_2 for details.