Which is faster on a dashboard, post processing or using saved searches

[randy_moore]

A little background:

• We have a single instance install now and are moving to a multisite index cluster and multisite SH cluster.
• Our dashboards on the current single instance are 95% inline searches, with a few summary index panels and saved searches in the mix. Very small amount of those.
  
• No real-time searches.
• The dashboards have on average 15 panels that are refreshed every 2 minutes (and yes we need it refreshed that quickly).

I have been thinking of rewriting the searches to be base and post-processes. However as I have been reading about the changes needed in the dashboards when in the new environment, I have read some comments and articles where post-processing may not be suitable for multi-index sites. Doing that might be slower than saved searches.

Does anybody have any real-world experiences that they can share? I don't want to proceed down one path when the other might be better in the long run.

[mayurr98]

Post process search are inherently slower than individual. Typically I point people to post process searches when users or dashboards is maxing out system or user level concurrent searches. In short Post process search will always be slower, except for a very some set of cases.

Post process searches don't count against a user concurrency limit.
Slowness/performance of Post process search isn't well documented, but is a limitation/pitfall of using the technique. It commonly known among Splunk veterans. Not to say you cant optimize your base search to increase efficiency.

Here is some information on Post Processes. http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/Savedsearches#Post-process_searches.

Post from sideview utils (former Splunk Employee) third paragraph. https://answers.splunk.com/answers/85486/sideview-utils-postprocess-slow-speed-searchhead-or-indexer...

So I would suggest you to use saved searches.
Well I got this answers from the below link:
https://answers.splunk.com/answers/473936/why-are-my-post-process-searches-running-slower-th.html

let me know if this helps!