All Apps and Add-ons

Help with post processing search macro

vinodhchirumail
Engager

I have 5-6 panels in a dashboard, they are loading slowly.
I know I can speed it up by post search processing.
My question is - How to load 2nd panel after 1st panel has finished and so on.
Do I need to write a custom macro for that?

0 Karma
1 Solution

Sukisen1981
Champion

hi @vinodhchirumailla
if you just have a series of panels and you want to load them one after the other, you can set a token under the tag for one panel and then use a global comment macro (no need to write your own macro) for the next panel to start executing only after the first one finishes. Try something like this
This is for first panel, you need to add a token in the tag like this

   <done>
            <set token="show2"></set>

          </done>

Now you re-use this token in panel 2, something like this

<search>
          <query>index= index=blah blah `comment("start execution only if $show2$ IS SET")` |rest of your query....
....

You can in theory form a solution where panel 2 sets a token show3 under its done tag and then you re-use it in the search query for panel 3 and so on and so forth...

View solution in original post

niketn
Legend

@vinodhchirumailla before considering Post-Processing, have you identified why your search query is having performance issues?

Also if you have how post-processing is going to help you? Are all panel queries correlated so that you can use data from one panel to be chained to other? Do consider Post-Processing best practices to ensure that you are using it right way (instead of passing entire raw data sets to various panels and filtering complete data set as needed): https://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches#Best_practices

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Sukisen1981
Champion

hi @vinodhchirumailla
if you just have a series of panels and you want to load them one after the other, you can set a token under the tag for one panel and then use a global comment macro (no need to write your own macro) for the next panel to start executing only after the first one finishes. Try something like this
This is for first panel, you need to add a token in the tag like this

   <done>
            <set token="show2"></set>

          </done>

Now you re-use this token in panel 2, something like this

<search>
          <query>index= index=blah blah `comment("start execution only if $show2$ IS SET")` |rest of your query....
....

You can in theory form a solution where panel 2 sets a token show3 under its done tag and then you re-use it in the search query for panel 3 and so on and so forth...

vinodhchirumail
Engager

I tried the above and it works , thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Base searches run before post-processing searches.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...