Dashboards & Visualizations

using field in timechart queries


I have a dashboard with many panels. If i used the 'field' command for for the underlying queries, would that help save Splunk resources?

Or does Splunk already know what field to use when it see's 'timechart count by ' and then ignores the rest of the fields???

0 Karma

Ultra Champion

I believe that the timechart command will remove all unnecessary information.

What you could do is to ensure that your question before the timechart runs as efficiently as possible, e.g. specifying the correct index and sourcetype, search only for the time range you're interested in. You could even instruct Splunk to not extract any fields at all (KV_MODE = none in props.conf), and only extract what you need with (an efficient) rex.


Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...