I have a dashboard with many panels. If i used the 'field' command for for the underlying queries, would that help save Splunk resources?
Or does Splunk already know what field to use when it see's 'timechart count by
I believe that the timechart
command will remove all unnecessary information.
What you could do is to ensure that your question before the timechart
runs as efficiently as possible, e.g. specifying the correct index and sourcetype, search only for the time range you're interested in. You could even instruct Splunk to not extract any fields at all (KV_MODE = none
in props.conf), and only extract what you need with (an efficient) rex
.
/K