Is there a better way to do a dashboard using same database input for multiple panels?

[dirtebird]

I'm creating a new dashboard using an existing database input.  This dashboard will have multiple (7+) panels searching the same database input, with the same filtering criteria, but different grouping and aggregating.  I was wondering if there is a better way to do this?  Does this cause 7+ separate reads to the same DBInput when it could be accomplished in one?  Thanks!

[richgalloway · Accepted solution]

By default, each search in a dashboard runs independently.  That means 7 panels using the dbxquery command will generate 7 reads against the database.

The way to avoid that is with what's called "post-processing".  In post-processing, a base search makes the query against the database (or index) and later queries further process the results (grouping and aggregating).

See https://docs.splunk.com/Documentation/Splunk/9.0.0/Viz/Savedsearches#Post-process_searches_2 for details.