Dashboards & Visualizations

How can I optimize different searches, each containing almost the syntax for part of the search?



I have three dashboards which use almost the same part of the search (I also have a subsearch in the whole search string).
The only things that change is a key/value field and fields visualized in a table (at the end).

Should I create a macro with the part of the search which is the same? Or is it better to use summary indexing?


0 Karma

Revered Legend

If you've 3 separate dashboards with similar queries, you can have the common portion of the search made as saved search and use following for your dashboard searches

| savedsearch YourSavedSearchName | ---dashboard specific portions

See more details .

Splunk Employee
Splunk Employee

If you could retrieve all your results with a single search, look at the "postprocess" method.

see http://docs.splunk.com/Documentation/Splunk/6.2.5/Viz/Savedsearches#Post-process_searches

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...