I'm creating a new dashboard using an existing database input. This dashboard will have multiple (7+) panels searching the same database input, with the same filtering criteria, but different grouping and aggregating. I was wondering if there is a better way to do this? Does this cause 7+ separate reads to the same DBInput when it could be accomplished in one? Thanks!
By default, each search in a dashboard runs independently. That means 7 panels using the dbxquery command will generate 7 reads against the database.
The way to avoid that is with what's called "post-processing". In post-processing, a base search makes the query against the database (or index) and later queries further process the results (grouping and aggregating).
See https://docs.splunk.com/Documentation/Splunk/9.0.0/Viz/Savedsearches#Post-process_searches_2 for details.
By default, each search in a dashboard runs independently. That means 7 panels using the dbxquery command will generate 7 reads against the database.
The way to avoid that is with what's called "post-processing". In post-processing, a base search makes the query against the database (or index) and later queries further process the results (grouping and aggregating).
See https://docs.splunk.com/Documentation/Splunk/9.0.0/Viz/Savedsearches#Post-process_searches_2 for details.