I have a regular report that I have to provide to a customer, and we are utilizing Splunk as the mechanism to retrieve the data from the source. The dataset is too large to pull down and process locally, so I have several different look-ups written to pull specific data views for the report. However, since we are connecting to an external database to pull the data, I would like to limit the "hit" that database takes at one time.
With that said, is there a way to "control" how Splunk executes panel look ups? For instance, panel 1 executes immediately. After panel one contains data, panel 2 executes. After panel 2 contains data, panel 3 executes. And so on...
I have seen one strategy that basically has sub-searches off of one master search's data, but again, that data set would be so big, I don't know that a master search would even complete. Hence, I am looking for other options. Otherwise, I will continue to have to run individual look ups manually, which is not efficient.
@sarge338 refer to one of my answers which runs the searches one at a time only after previous one completes.