https://community.splunk.com/t5/Dashboards-Visualizations/Dashboard-performance-Multiple-searches/m-p/105892#M5973 <P>Free license of Splunk. Right now I have a dashboard with 15 single value searches and I have noticed that sometimes not all of them will refresh. But after a few F5 refresh they will all eventually. The 15 single values are saved searches. Is this a hardware issue or is there a better way of doing so many searches?</P> Fri, 17 Dec 2010 00:33:07 GMT jasonhblackwell 2010-12-17T00:33:07Z https://community.splunk.com/t5/Dashboards-Visualizations/Dashboard-performance-Multiple-searches/m-p/105892#M5973 <P>Free license of Splunk. Right now I have a dashboard with 15 single value searches and I have noticed that sometimes not all of them will refresh. But after a few F5 refresh they will all eventually. The 15 single values are saved searches. Is this a hardware issue or is there a better way of doing so many searches?</P> Fri, 17 Dec 2010 00:33:07 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Dashboard-performance-Multiple-searches/m-p/105892#M5973 jasonhblackwell 2010-12-17T00:33:07Z https://community.splunk.com/t5/Dashboards-Visualizations/Dashboard-performance-Multiple-searches/m-p/105893#M5974 <P>It depends on what you're actually searching. Usually the best approach is to use Advanced XML and the <CODE>HiddenPostProcess</CODE> module.</P> <P>This lets you create one master search with <CODE>HiddenSearch</CODE>, then below that define <CODE>HiddenPostProcess</CODE> searches which narrow the results down.</P> <P>This should help get you started: <BR />&nbsp;&nbsp;&nbsp;&nbsp; <A href="http://www.splunk.com/base/Documentation/4.1.6/Developer/PostProcess" rel="nofollow">http://www.splunk.com/base/Documentation/4.1.6/Developer/PostProcess</A></P> <P>If you need more examples, there's at least one in the <A href="http://splunkbase.splunk.com/apps/All/4.x/Add-On/app:UI+Examples" rel="nofollow">UI Examples</A> app on SplunkBase. It's also used in the OSSEC app, among others.</P> Fri, 17 Dec 2010 01:14:24 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Dashboard-performance-Multiple-searches/m-p/105893#M5974 southeringtonp 2010-12-17T01:14:24Z