Dashboards & Visualizations

How do you control look ups in a multi-panel dashboard?

sarge338
Path Finder

Hello

I have a regular report that I have to provide to a customer, and we are utilizing Splunk as the mechanism to retrieve the data from the source. The dataset is too large to pull down and process locally, so I have several different look-ups written to pull specific data views for the report. However, since we are connecting to an external database to pull the data, I would like to limit the "hit" that database takes at one time.

With that said, is there a way to "control" how Splunk executes panel look ups? For instance, panel 1 executes immediately. After panel one contains data, panel 2 executes. After panel 2 contains data, panel 3 executes. And so on...

I have seen one strategy that basically has sub-searches off of one master search's data, but again, that data set would be so big, I don't know that a master search would even complete. Hence, I am looking for other options. Otherwise, I will continue to have to run individual look ups manually, which is not efficient.

Thank you.

0 Karma

niketn
Legend

@sarge338 refer to one of my answers which runs the searches one at a time only after previous one completes.

https://answers.splunk.com/answers/683826/how-do-you-set-the-order-of-queries-to-be-run-in-a.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

sarge338
Path Finder

@niketnilay that looks JUST like what I'm looking for! I'll give that a shot, and let you know how it goes!

Thanks!!

0 Karma

sarge338
Path Finder

That worked beautifully! Now my entire dashboard can populate without straining the database.

Thanks!!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...