All Apps and Add-ons

Sideview Utils - additional Search " admin search *"

KarunK
Contributor

Hi,

My apps uses Sideview util and when it load one of my dashboard it will take too much time. When i checked the searches.log its doing and additional search (admin search *) before my actual dashboard search, which is taking too much time as it searched through all the index.

I believe this is bug. Could any one please help us in finding a workaround ? I am running latest version of the Sideview Util - version 5.

Thanks

Regards

0 Karma

sideview
SplunkTrust
SplunkTrust

This is most likely not a problem with Sideview Utils specifically, but just with how the modules are nested inside eachother. The new Sideview Utils (1.2.5), has a new docs page that tries to give an understanding of how modules work with eachother, and specifically where and when searches get dispatched.

In short, it's quite possible to create views where, because of how the modules are arranged, you dispatch one or more unwanted searches. And such unwanted searches are often the dreaded "*" searches over all time.

Please paste in the XML, or email it to me, and I'd be happy to take a look and find the problem for you.

0 Karma

sideview
SplunkTrust
SplunkTrust

NOTE: For anyone else who wants to understand how the Advanced XML really works, check out the "Introduction to the Advanced XML" documentation page in the latest Sideview Utils app. It's a dense page, but you will come away understanding the upstream/downstream concept, and more impressive, understanding why, when, how and where the UI dispatches searches in your views at runtime.

0 Karma

sideview
SplunkTrust
SplunkTrust

Go ahead and send me the XML (nick@sideviewapps.com) and I'll show you what to change -- I'll bet you anything that even the dispatch of your "inputlookup" search can be removed.

0 Karma

KarunK
Contributor

Hi Nick,

Thanks for the Response. Sorry for being so late to respond, was away. I have figured it out that this may not a be a bug but as you said because of the way modules are arranged. So i have to inserts a search which does a simple csvlookup. "search *" is no longer happening. Thanks for your help.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...

SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...