Dashboards & Visualizations

Simple XML : multi search optimisation

mclane1
Path Finder

I have one dashboard with 1 entry (time) and 23 charts.
Then I have 23 searchs like this:

criteria1 criteriaA | format1
criteria1 criteriaB | format1
criteria1 criteriaC | format1
criteria1 criteriaA | format2
criteria1 criteriaB | format2
criteria1 criteriaC | format2
criteria1 criteriaA criteriaX | format3
criteria1 criteriaB criteriaX | format3
criteria1 criteriaC criteriaX | format3
...

I would like optimize the search because it's very slow.
I found : <form><search id="xyz"/><row><chart><search id="xyz"/>...
but I see it's just for the reading, not faster.

Anyone know how to accelerate the research?

0 Karma

adambloom
Path Finder

Did you take a look at http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/Savedsearches#Post-process_searches? It looks like you could use a base search (or maybe 3 base searches, one per combination of criteria 1 with criteriaA/B/C) and build the panels with post processing searches. That will speed up your dashboard since the raw data will only need to be loaded to execute the base search. It looked like you found something similar, but I'm not sure why you think it won't make your dashboard faster if you adapt it for your needs.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!