topic Re: does drilldown option contribute in search optimization in Splunk Search

does drilldown option contribute in search optimization

mdmaala — Tue, 19 Mar 2019 15:05:42 GMT

does drilldown option help in optimizing the search? because when I try to place all the panels in one dashboard, the search is getting slower, thus, causing delays in the real time visualization.

Re: does drilldown option contribute in search optimization

niketn — Tue, 19 Mar 2019 17:19:15 GMT

@mdmaala, search optimization depends on several conditions and community would be able to assist you better if you can provide the searches running in your dashboard and also how you plan to use drilldown.

If your drilldown filters results being pulled back from index, it would help as there will be less event to search. Refer to Splunk documentation on Search Optimization.

By Real-Time visualization do you mean searches running on Real-Time time window? If so do understand the limitation of Real-Time Searches

Re: does drilldown option contribute in search optimization

mdmaala — Tue, 19 Mar 2019 21:25:17 GMT

thank you so much @niketnilay I will look on these. By real time visualization, what I mean is once the log file updates, the dashboard will also update. In my case, one the light changes from one state to another, the dashboard should immediately display the total duration of the previous state. For now, I will try summary indexing along with doing a drilldown to optimize the searching.

Re: does drilldown option contribute in search optimization

mdmaala — Wed, 20 Mar 2019 06:42:02 GMT

thank you so much @niketnilay ! I will look on these. by real time visualization what I mean is that once the data updates where splunk indexes its file from, the dashboard will automatically update.