Dropdown menu (speed??)

[DTERM]

Can the speed of a form that utilizes a drop down menu be increased? I'm generating a menu based on a query and my users are complaining the application is too slow. I'd prefer not to input a static list into the dropdown.

If it helps any, here is the code:

<form class="formsearch">
<label>Top Products</label>
<searchTemplate>index=myapp supportGroup=$supportGroup$ | top 10 productName </searchTemplate> 

<fieldset>
    <input type="dropdown" token="supportGroup" searchWhenChanged="true">
        <label>Select Support Group</label>
        <populatingSearch fieldForValue="supportGroup" fieldForLabel="supportGroup">    <![CDATA[index=myapp supportGroup | top supportGroup]]></populatingSearch>
        <choice value="*">Any</choice> 
    </input>
    <input type="time">
         <default>Last 7 days</default>
    </input>
</fieldset>

  <row>
    <chart>
      <title>Top Product Names</title>
      <option name="charting.chart">pie</option>
      <option name="drilldown">all</option>
    </chart>
    <chart>
      <title>Top Product Names</title>
      <option name="drilldown">all</option>
    </chart>
  </row>
  <row>
    <table>
      <title>Top Product Names</title>
      <option name="drilldown">all</option>
    </table>
  </row>


</form>

[Ayn · Accepted solution]

What takes time is running the populating search - the 'speed' of the form will only ever be as fast as that search. So whatever you can do to make that go faster will make things better. Some suggestions:

• Limit the timespan of the search as much as possible. Do you need to search 7 days worth of data or is it enough just to check, say, the last 12 hours?
• Optimize the search. I'm no expert regarding the internals of how Splunk handles your query, but I think it's about as optimized as it can be. The thing I can think of is that you might want to try to use supportGroup="*" rather than just supportGroup. My guess though is that any difference in performance you get is neglectable. Still, it's worth a try.
• Most importantly, if you really want to have a solution that scales, consider using summary indexing. This will speed up the populating search significantly, as Splunk can just grab the previously gathered stats right away rather than having to calculate it all in real-time. For more information, check the docs; for instance http://docs.splunk.com/Documentation/Splunk/4.2.3/Knowledge/Usesummaryindexing