Help with post processing search macro

[vinodhchirumail]

I have 5-6 panels in a dashboard, they are loading slowly.
I know I can speed it up by post search processing.
My question is - How to load 2nd panel after 1st panel has finished and so on.
Do I need to write a custom macro for that?

[niketn]

@vinodhchirumailla before considering Post-Processing, have you identified why your search query is having performance issues?

Also if you have how post-processing is going to help you? Are all panel queries correlated so that you can use data from one panel to be chained to other? Do consider Post-Processing best practices to ensure that you are using it right way (instead of passing entire raw data sets to various panels and filtering complete data set as needed): https://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches#Best_practices

[Sukisen1981 · Accepted solution]

hi @vinodhchirumailla
if you just have a series of panels and you want to load them one after the other, you can set a token under the tag for one panel and then use a global comment macro (no need to write your own macro) for the next panel to start executing only after the first one finishes. Try something like this
This is for first panel, you need to add a token in the tag like this

   <done>
            <set token="show2"></set>

          </done>

Now you re-use this token in panel 2, something like this

<search>
          <query>index= index=blah blah `comment("start execution only if $show2$ IS SET")` |rest of your query....
....

You can in theory form a solution where panel 2 sets a token show3 under its done tag and then you re-use it in the search query for panel 3 and so on and so forth...

[vinodhchirumail]

I tried the above and it works , thanks

[richgalloway]

Base searches run before post-processing searches.