Accelerate Search results in dashboard

[Amirahussein]

i am searching for a way to accelerate dashboard
the dashboard contains 4 panels, each of them is running same search but with different time picker
i mean:
Panel 1: for 1 hour
Panel 2: for 24 hours
panel 3: for 1 week
panel 4: for 1 month

the 3 panels are taking too much time till viewing the results (line chart)
so i need such an easy way to enhance the dashboard performance

[cmerriman]

There are a few ways.

1. You could have post process. Set the base search to the longest time range and keep _time in the results. In the panel queries, add a clause to filter down to the correct time range. I'd probably use a relative_time eval. Then finish the query out.

2. Create a summary index and search that.

3. Create an accelerated data model to search.

4. Create saved searches for each panel, or I suppose, in a manner similar to what I described in scenario 1, you could create one saved search that includes _time and filter it down in each panel.

[woodcock]

If your #4 is "Schedule the long searches to run every hour and pull in the results using loadjob" then I agree with your answer. I would try #1, #4, #2, then #3 (#3 has a significant disk impact).