Dashboards & Visualizations

dynamic form... is it normal to be this slow?

mikefoti
Communicator

A simple query runs very quickly (3s)... but when I use that same query to build a dynamic form (either radio or dropdown) the query takes apporx 60s. As a test I have eliminated charts so the form only creates a dropdown list (or radio buttons) plus a row of static HTML (becuase apparently I must have a childobject within the form). But it still takes approx 60s.

My question is... is this normal.. or is there soemthing wrong with my simple XML?

    <form>
<label>Test InvertedFlow 5</label>
<fieldset autoRun="true">
<input type="radio" token="ip">
<label>Select Store IP</label>
<populatingSearch fieldForValue="nps_radiusClientIP" fieldForLabel="nps_radiusClientIP">
<![CDATA[index=winradius eventtype=nps_accessReqRejected | top nps_radiusClientIP]]>
</populatingSearch>
<earliestTime>-4h</earliestTime>
<latestTime>now</latestTime>
</input>

<input type="time">
<default>Last 4 Hours</default>
</input>
</fieldset>

<row>
<html>
<p>This is an <i><b>HTML panel</b></i> providing links to saved searches.</p>
</html>
</row>
</form>
0 Karma
1 Solution

mikefoti
Communicator

Through trial and error I discovered, when possible/practicable, replacing the dynamically populated lookup (where list items are generated from query results) with a static lookup (where list items are coded within the xml) is much quicker. In hind site this seems kind of obvious. Whether trying to populate a list of radio buttons or a drop-down list, it will take longer if splunk has to query an index vs simply pulling list items right out of the xml it is already reading.

More info on how to replace a dynamically populated drop-down with a static drop-down here
http://splunk-base.splunk.com/answers/51663/convert-dynamic-drop-down-to-static-in-advanced-xml

View solution in original post

0 Karma

lguinn2
Legend
index=winradius eventtype=nps_accessReqRejected | top nps_radiusClientIP

runs over all time. change it to

index=winradius eventtype=nps_accessReqRejected earliest=-24h | top nps_radiusClientIP

and I'll bet it runs much much faster...

0 Karma

mikefoti
Communicator

Through trial and error I discovered, when possible/practicable, replacing the dynamically populated lookup (where list items are generated from query results) with a static lookup (where list items are coded within the xml) is much quicker. In hind site this seems kind of obvious. Whether trying to populate a list of radio buttons or a drop-down list, it will take longer if splunk has to query an index vs simply pulling list items right out of the xml it is already reading.

More info on how to replace a dynamically populated drop-down with a static drop-down here
http://splunk-base.splunk.com/answers/51663/convert-dynamic-drop-down-to-static-in-advanced-xml

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...