Dashboards & Visualizations

dynamic form... is it normal to be this slow?

mikefoti
Communicator

A simple query runs very quickly (3s)... but when I use that same query to build a dynamic form (either radio or dropdown) the query takes apporx 60s. As a test I have eliminated charts so the form only creates a dropdown list (or radio buttons) plus a row of static HTML (becuase apparently I must have a childobject within the form). But it still takes approx 60s.

My question is... is this normal.. or is there soemthing wrong with my simple XML?

    <form>
<label>Test InvertedFlow 5</label>
<fieldset autoRun="true">
<input type="radio" token="ip">
<label>Select Store IP</label>
<populatingSearch fieldForValue="nps_radiusClientIP" fieldForLabel="nps_radiusClientIP">
<![CDATA[index=winradius eventtype=nps_accessReqRejected | top nps_radiusClientIP]]>
</populatingSearch>
<earliestTime>-4h</earliestTime>
<latestTime>now</latestTime>
</input>

<input type="time">
<default>Last 4 Hours</default>
</input>
</fieldset>

<row>
<html>
<p>This is an <i><b>HTML panel</b></i> providing links to saved searches.</p>
</html>
</row>
</form>
0 Karma
1 Solution

mikefoti
Communicator

Through trial and error I discovered, when possible/practicable, replacing the dynamically populated lookup (where list items are generated from query results) with a static lookup (where list items are coded within the xml) is much quicker. In hind site this seems kind of obvious. Whether trying to populate a list of radio buttons or a drop-down list, it will take longer if splunk has to query an index vs simply pulling list items right out of the xml it is already reading.

More info on how to replace a dynamically populated drop-down with a static drop-down here
http://splunk-base.splunk.com/answers/51663/convert-dynamic-drop-down-to-static-in-advanced-xml

View solution in original post

0 Karma

lguinn2
Legend
index=winradius eventtype=nps_accessReqRejected | top nps_radiusClientIP

runs over all time. change it to

index=winradius eventtype=nps_accessReqRejected earliest=-24h | top nps_radiusClientIP

and I'll bet it runs much much faster...

0 Karma

mikefoti
Communicator

Through trial and error I discovered, when possible/practicable, replacing the dynamically populated lookup (where list items are generated from query results) with a static lookup (where list items are coded within the xml) is much quicker. In hind site this seems kind of obvious. Whether trying to populate a list of radio buttons or a drop-down list, it will take longer if splunk has to query an index vs simply pulling list items right out of the xml it is already reading.

More info on how to replace a dynamically populated drop-down with a static drop-down here
http://splunk-base.splunk.com/answers/51663/convert-dynamic-drop-down-to-static-in-advanced-xml

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...