How can I optimize different searches, each containing almost the syntax for part of the search?

[skender27]

Hi,

I have three dashboards which use almost the same part of the search (I also have a subsearch in the whole search string).
The only things that change is a key/value field and fields visualized in a table (at the end).

Should I create a macro with the part of the search which is the same? Or is it better to use summary indexing?

Thanks,
Skender

[somesoni2]

If you've 3 separate dashboards with similar queries, you can have the common portion of the search made as saved search and use following for your dashboard searches

| savedsearch YourSavedSearchName | ---dashboard specific portions

See more details .
http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/Savedsearch

[yannK]

If you could retrieve all your results with a single search, look at the "postprocess" method.

see http://docs.splunk.com/Documentation/Splunk/6.2.5/Viz/Savedsearches#Post-process_searches