Dashboards & Visualizations

Simple XML : multi search optimisation

Path Finder

I have one dashboard with 1 entry (time) and 23 charts.
Then I have 23 searchs like this:

criteria1 criteriaA | format1
criteria1 criteriaB | format1
criteria1 criteriaC | format1
criteria1 criteriaA | format2
criteria1 criteriaB | format2
criteria1 criteriaC | format2
criteria1 criteriaA criteriaX | format3
criteria1 criteriaB criteriaX | format3
criteria1 criteriaC criteriaX | format3

I would like optimize the search because it's very slow.
I found : <form><search id="xyz"/><row><chart><search id="xyz"/>...
but I see it's just for the reading, not faster.

Anyone know how to accelerate the research?

0 Karma

Path Finder

Did you take a look at http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/Savedsearches#Post-process_searches? It looks like you could use a base search (or maybe 3 base searches, one per combination of criteria 1 with criteriaA/B/C) and build the panels with post processing searches. That will speed up your dashboard since the raw data will only need to be loaded to execute the base search. It looked like you found something similar, but I'm not sure why you think it won't make your dashboard faster if you adapt it for your needs.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...