Splunk Dev

Searches for hidden graphes are run

pduflot
Path Finder

Hello,

I have a dashboard where some graphes are hidden because they depend on a token that is not defined.
However, it seems that the searches that populate those graphes are still run. I see this because the number of access to the accelerated reports increased.
Can somebody confirm? If yes, How is it possible to prevent those searches to run? It slows down the display of the dashboard.

Basically I have:
2 base searches:
- NormalSearch
- ExtendedSearch

When the user goes to extended mode. All normal graphes are hidden and all extended graphes are shown.

Thanks!

0 Karma
1 Solution

woodcock
Esteemed Legend

Add a do-nothing reference to one of the tokens into each of the searches that do not have them. You can do this by postpending this to every search:

... | rename CommandPreventsThisSearchFromAutoRunningBeforeTokensAreSet AS $SomeToken$

View solution in original post

woodcock
Esteemed Legend

Add a do-nothing reference to one of the tokens into each of the searches that do not have them. You can do this by postpending this to every search:

... | rename CommandPreventsThisSearchFromAutoRunningBeforeTokensAreSet AS $SomeToken$

pduflot
Path Finder

Nice trick. Works well, thanks!

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...