Dashboards & Visualizations

Optimising dashboard. Make all visualisations use same search?


I have a dashboard which renders 10 different visualisations but they are all using the same search string for splunk. E.g the following log entry is what I am searching for:

Settings: Data1:Value1 Data2:Value2 Data 3:Value3

I then parse the line for each visualisation. We have thousands of entries so the search can take quite a long time and it seems to do the search 10 times, once foe each visualisation. Is there a way to do one search and then use that search for each visualisation?


0 Karma


Post processing might work, but it sounds like you'd have a lot of results from the base search. IIRC, post processing has a 10k limit. Instead, I would save your base search as a scheduled search, then use loadjob in each panel's query.


Panel query:

| loadjob savedsearch="myuserid:my_cool_app:my_saved_base_search" | timechart ...
0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...