Developing for Splunk Enterprise
Highlighted

Searches for hidden graphes are run

Path Finder

Hello,

I have a dashboard where some graphes are hidden because they depend on a token that is not defined.
However, it seems that the searches that populate those graphes are still run. I see this because the number of access to the accelerated reports increased.
Can somebody confirm? If yes, How is it possible to prevent those searches to run? It slows down the display of the dashboard.

Basically I have:
2 base searches:
- NormalSearch
- ExtendedSearch

When the user goes to extended mode. All normal graphes are hidden and all extended graphes are shown.

Thanks!

0 Karma
Highlighted

Re: Searches for hidden graphes are run

Esteemed Legend

Add a do-nothing reference to one of the tokens into each of the searches that do not have them. You can do this by postpending this to every search:

... | rename CommandPreventsThisSearchFromAutoRunningBeforeTokensAreSet AS $SomeToken$

View solution in original post

Highlighted

Re: Searches for hidden graphes are run

Path Finder

Nice trick. Works well, thanks!

0 Karma