How does a post-process search work in Splunk?

[sainadh1247]

How do post-process searches work in Splunk?

In my dashboard there are 4 panels. Around 3-4 sub searches are repeating in every panel which resulting performance issue and dashboard not displaying any data.

Using Post-process searches will be helpful in my scenario. Or else please suggest other alternatives.

[cmerriman]

a post process is used as the base search, not as the subsearch. You might benefit more from creating a summary index or a data model to try to accelerate performance.

[sundareshr]

Without looking at your dashboard and the queries, it is hard to tell. If done right, post process could significantly help dashboard performance. However, there are some limitation you have to be aware of when you design your dashboard.

http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/Savedsearches#Post-process_searches