Dashboards & Visualizations

using field in timechart queries

subtrakt
Contributor

I have a dashboard with many panels. If i used the 'field' command for for the underlying queries, would that help save Splunk resources?

Or does Splunk already know what field to use when it see's 'timechart count by ' and then ignores the rest of the fields???

0 Karma

kristian_kolb
Ultra Champion

I believe that the timechart command will remove all unnecessary information.

What you could do is to ensure that your question before the timechart runs as efficiently as possible, e.g. specifying the correct index and sourcetype, search only for the time range you're interested in. You could even instruct Splunk to not extract any fields at all (KV_MODE = none in props.conf), and only extract what you need with (an efficient) rex.

/K

Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...