Knowledge Management

best practice for search

jangid
Builder

I have a dashboard and in this dashboard I can provide search criteria in two way.

  1. mysearch
  2. savedsearch

Which one is best approach? I can achieve my goal with both of them but just want to know is there any performance improvement?

Thanks

Tags (1)
0 Karma
1 Solution

Drainy
Champion

Saved searches always offer the best performance as Splunk will check to see if the same search is already being executed or if it has any saved results and use those.

If you just put an inline search then every time the dashboard is loaded it will execute the search, that means that if 4 users access the same dashboard it will fire 4 times. If it was a saved search then all 4 users would load the 1 set of search results.

View solution in original post

Drainy
Champion

Saved searches always offer the best performance as Splunk will check to see if the same search is already being executed or if it has any saved results and use those.

If you just put an inline search then every time the dashboard is loaded it will execute the search, that means that if 4 users access the same dashboard it will fire 4 times. If it was a saved search then all 4 users would load the 1 set of search results.

Drainy
Champion

Did you use the usehistory option I explained in another window? Also you need to schedule the search, that way it will load the search at the scheduled time and then dashboards will load the cached results and NOT run the search

0 Karma

jangid
Builder

Hi Drainy sorry to bother you again.
but there is no difference in both search.
I tried with saved search and taking same time, there is no performance improvement even if I open in multiple browser window it'll take same amount of time for all instance.

0 Karma

Drainy
Champion

Splunk will store it as you will have to change the permissions so it is available to the app or globally for it to work across all users anyway 🙂

0 Karma

jangid
Builder

Thanks Drainy,
do you mean splunk will store the result somewhere or user stored search result?

If savedsearch is good for app then is it good to create some saved search and distribute with app in default/savedsearches.conf?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...