Dashboards & Visualizations

How do you control look ups in a multi-panel dashboard?

sarge338
Path Finder

Hello

I have a regular report that I have to provide to a customer, and we are utilizing Splunk as the mechanism to retrieve the data from the source. The dataset is too large to pull down and process locally, so I have several different look-ups written to pull specific data views for the report. However, since we are connecting to an external database to pull the data, I would like to limit the "hit" that database takes at one time.

With that said, is there a way to "control" how Splunk executes panel look ups? For instance, panel 1 executes immediately. After panel one contains data, panel 2 executes. After panel 2 contains data, panel 3 executes. And so on...

I have seen one strategy that basically has sub-searches off of one master search's data, but again, that data set would be so big, I don't know that a master search would even complete. Hence, I am looking for other options. Otherwise, I will continue to have to run individual look ups manually, which is not efficient.

Thank you.

0 Karma

niketn
Legend

@sarge338 refer to one of my answers which runs the searches one at a time only after previous one completes.

https://answers.splunk.com/answers/683826/how-do-you-set-the-order-of-queries-to-be-run-in-a.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

sarge338
Path Finder

@niketnilay that looks JUST like what I'm looking for! I'll give that a shot, and let you know how it goes!

Thanks!!

0 Karma

sarge338
Path Finder

That worked beautifully! Now my entire dashboard can populate without straining the database.

Thanks!!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...