Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- dynamic form... is it normal to be this slow?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
A simple query runs very quickly (3s)... but when I use that same query to build a dynamic form (either radio or dropdown) the query takes apporx 60s. As a test I have eliminated charts so the form only creates a dropdown list (or radio buttons) plus a row of static HTML (becuase apparently I must have a childobject within the form). But it still takes approx 60s.
My question is... is this normal.. or is there soemthing wrong with my simple XML?
<form>
<label>Test InvertedFlow 5</label>
<fieldset autoRun="true">
<input type="radio" token="ip">
<label>Select Store IP</label>
<populatingSearch fieldForValue="nps_radiusClientIP" fieldForLabel="nps_radiusClientIP">
<![CDATA[index=winradius eventtype=nps_accessReqRejected | top nps_radiusClientIP]]>
</populatingSearch>
<earliestTime>-4h</earliestTime>
<latestTime>now</latestTime>
</input>
<input type="time">
<default>Last 4 Hours</default>
</input>
</fieldset>
<row>
<html>
<p>This is an <i><b>HTML panel</b></i> providing links to saved searches.</p>
</html>
</row>
</form>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Through trial and error I discovered, when possible/practicable, replacing the dynamically populated lookup (where list items are generated from query results) with a static lookup (where list items are coded within the xml) is much quicker. In hind site this seems kind of obvious. Whether trying to populate a list of radio buttons or a drop-down list, it will take longer if splunk has to query an index vs simply pulling list items right out of the xml it is already reading.
More info on how to replace a dynamically populated drop-down with a static drop-down here
http://splunk-base.splunk.com/answers/51663/convert-dynamic-drop-down-to-static-in-advanced-xml
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
index=winradius eventtype=nps_accessReqRejected | top nps_radiusClientIP
runs over all time. change it to
index=winradius eventtype=nps_accessReqRejected earliest=-24h | top nps_radiusClientIP
and I'll bet it runs much much faster...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Through trial and error I discovered, when possible/practicable, replacing the dynamically populated lookup (where list items are generated from query results) with a static lookup (where list items are coded within the xml) is much quicker. In hind site this seems kind of obvious. Whether trying to populate a list of radio buttons or a drop-down list, it will take longer if splunk has to query an index vs simply pulling list items right out of the xml it is already reading.
More info on how to replace a dynamically populated drop-down with a static drop-down here
http://splunk-base.splunk.com/answers/51663/convert-dynamic-drop-down-to-static-in-advanced-xml
Splunk App for Anomaly Detection End of Life Announcement
Aligning Observability Costs with Business Value: Practical Strategies
Mastering Data Pipelines: Unlocking Value with Splunk
