Dashboards & Visualizations

Accelerate Search results in dashboard

Amirahussein
Explorer

i am searching for a way to accelerate dashboard
the dashboard contains 4 panels, each of them is running same search but with different time picker
i mean:
Panel 1: for 1 hour
Panel 2: for 24 hours
panel 3: for 1 week
panel 4: for 1 month

the 3 panels are taking too much time till viewing the results (line chart)
so i need such an easy way to enhance the dashboard performance

Tags (1)
0 Karma

cmerriman
Super Champion

There are a few ways.

  1. You could have post process. Set the base search to the longest time range and keep _time in the results. In the panel queries, add a clause to filter down to the correct time range. I'd probably use a relative_time eval. Then finish the query out.

  2. Create a summary index and search that.

  3. Create an accelerated data model to search.

  4. Create saved searches for each panel, or I suppose, in a manner similar to what I described in scenario 1, you could create one saved search that includes _time and filter it down in each panel.

woodcock
Esteemed Legend

If your #4 is "Schedule the long searches to run every hour and pull in the results using loadjob" then I agree with your answer. I would try #1, #4, #2, then #3 (#3 has a significant disk impact).

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!