Dashboards & Visualizations

using field in timechart queries

subtrakt
Contributor

I have a dashboard with many panels. If i used the 'field' command for for the underlying queries, would that help save Splunk resources?

Or does Splunk already know what field to use when it see's 'timechart count by ' and then ignores the rest of the fields???

0 Karma

kristian_kolb
Ultra Champion

I believe that the timechart command will remove all unnecessary information.

What you could do is to ensure that your question before the timechart runs as efficiently as possible, e.g. specifying the correct index and sourcetype, search only for the time range you're interested in. You could even instruct Splunk to not extract any fields at all (KV_MODE = none in props.conf), and only extract what you need with (an efficient) rex.

/K

Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...