Archive

Accelerate Search results in dashboard

Explorer

i am searching for a way to accelerate dashboard
the dashboard contains 4 panels, each of them is running same search but with different time picker
i mean:
Panel 1: for 1 hour
Panel 2: for 24 hours
panel 3: for 1 week
panel 4: for 1 month

the 3 panels are taking too much time till viewing the results (line chart)
so i need such an easy way to enhance the dashboard performance

Tags (1)
0 Karma

Super Champion

There are a few ways.

  1. You could have post process. Set the base search to the longest time range and keep _time in the results. In the panel queries, add a clause to filter down to the correct time range. I'd probably use a relative_time eval. Then finish the query out.

  2. Create a summary index and search that.

  3. Create an accelerated data model to search.

  4. Create saved searches for each panel, or I suppose, in a manner similar to what I described in scenario 1, you could create one saved search that includes _time and filter it down in each panel.

Esteemed Legend

If your #4 is "Schedule the long searches to run every hour and pull in the results using loadjob" then I agree with your answer. I would try #1, #4, #2, then #3 (#3 has a significant disk impact).

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!