Dashboards & Visualizations

Simple XML : multi search optimisation

mclane1
Path Finder

I have one dashboard with 1 entry (time) and 23 charts.
Then I have 23 searchs like this:

criteria1 criteriaA | format1
criteria1 criteriaB | format1
criteria1 criteriaC | format1
criteria1 criteriaA | format2
criteria1 criteriaB | format2
criteria1 criteriaC | format2
criteria1 criteriaA criteriaX | format3
criteria1 criteriaB criteriaX | format3
criteria1 criteriaC criteriaX | format3
...

I would like optimize the search because it's very slow.
I found : <form><search id="xyz"/><row><chart><search id="xyz"/>...
but I see it's just for the reading, not faster.

Anyone know how to accelerate the research?

0 Karma

adambloom
Path Finder

Did you take a look at http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/Savedsearches#Post-process_searches? It looks like you could use a base search (or maybe 3 base searches, one per combination of criteria 1 with criteriaA/B/C) and build the panels with post processing searches. That will speed up your dashboard since the raw data will only need to be loaded to execute the base search. It looked like you found something similar, but I'm not sure why you think it won't make your dashboard faster if you adapt it for your needs.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!