Optimising dashboard. Make all visualisations use same search?

[allanmb]

I have a dashboard which renders 10 different visualisations but they are all using the same search string for splunk. E.g the following log entry is what I am searching for:

Settings: Data1:Value1 Data2:Value2 Data 3:Value3

I then parse the line for each visualisation. We have thousands of entries so the search can take quite a long time and it seems to do the search 10 times, once foe each visualisation. Is there a way to do one search and then use that search for each visualisation?

Thanks

[twinspop]

Post processing might work, but it sounds like you'd have a lot of results from the base search. IIRC, post processing has a 10k limit. Instead, I would save your base search as a scheduled search, then use loadjob in each panel's query.

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Loadjob

Panel query:

| loadjob savedsearch="myuserid:my_cool_app:my_saved_base_search" | timechart ...