Dashboards & Visualizations
Highlighted

How can I optimize different searches, each containing almost the syntax for part of the search?

Contributor

Hi,

I have three dashboards which use almost the same part of the search (I also have a subsearch in the whole search string).
The only things that change is a key/value field and fields visualized in a table (at the end).

Should I create a macro with the part of the search which is the same? Or is it better to use summary indexing?

Thanks,
Skender

0 Karma
Highlighted

Re: How can I optimize different searches, each containing almost the syntax for part of the search?

Ultra Champion

If you could retrieve all your results with a single search, look at the "postprocess" method.

see http://docs.splunk.com/Documentation/Splunk/6.2.5/Viz/Savedsearches#Post-process_searches

0 Karma
Highlighted

Re: How can I optimize different searches, each containing almost the syntax for part of the search?

SplunkTrust
SplunkTrust

If you've 3 separate dashboards with similar queries, you can have the common portion of the search made as saved search and use following for your dashboard searches

| savedsearch YourSavedSearchName | ---dashboard specific portions

See more details .
http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/Savedsearch

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.