Dashboards & Visualizations

How does a post-process search work in Splunk?

sainadh1247
New Member

How do post-process searches work in Splunk?

In my dashboard there are 4 panels. Around 3-4 sub searches are repeating in every panel which resulting performance issue and dashboard not displaying any data.

Using Post-process searches will be helpful in my scenario. Or else please suggest other alternatives.

0 Karma

cmerriman
Super Champion

a post process is used as the base search, not as the subsearch. You might benefit more from creating a summary index or a data model to try to accelerate performance.

0 Karma

sundareshr
Legend

Without looking at your dashboard and the queries, it is hard to tell. If done right, post process could significantly help dashboard performance. However, there are some limitation you have to be aware of when you design your dashboard.

http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/Savedsearches#Post-process_searches

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...