Dashboards & Visualizations

How can I optimize different searches, each containing almost the syntax for part of the search?

skender27
Contributor

Hi,

I have three dashboards which use almost the same part of the search (I also have a subsearch in the whole search string).
The only things that change is a key/value field and fields visualized in a table (at the end).

Should I create a macro with the part of the search which is the same? Or is it better to use summary indexing?

Thanks,
Skender

0 Karma

somesoni2
SplunkTrust
SplunkTrust

If you've 3 separate dashboards with similar queries, you can have the common portion of the search made as saved search and use following for your dashboard searches

| savedsearch YourSavedSearchName | ---dashboard specific portions

See more details .
http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/Savedsearch

yannK
Splunk Employee
Splunk Employee

If you could retrieve all your results with a single search, look at the "postprocess" method.

see http://docs.splunk.com/Documentation/Splunk/6.2.5/Viz/Savedsearches#Post-process_searches

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...