best practice for search

[jangid]

I have a dashboard and in this dashboard I can provide search criteria in two way.

1. mysearch
2. savedsearch

Which one is best approach? I can achieve my goal with both of them but just want to know is there any performance improvement?

Thanks

[Drainy · Accepted solution]

Saved searches always offer the best performance as Splunk will check to see if the same search is already being executed or if it has any saved results and use those.

If you just put an inline search then every time the dashboard is loaded it will execute the search, that means that if 4 users access the same dashboard it will fire 4 times. If it was a saved search then all 4 users would load the 1 set of search results.

[Drainy]

Did you use the usehistory option I explained in another window? Also you need to schedule the search, that way it will load the search at the scheduled time and then dashboards will load the cached results and NOT run the search

[jangid]

Hi Drainy sorry to bother you again.
but there is no difference in both search.
I tried with saved search and taking same time, there is no performance improvement even if I open in multiple browser window it'll take same amount of time for all instance.

[Drainy]

Splunk will store it as you will have to change the permissions so it is available to the app or globally for it to work across all users anyway 🙂

[jangid]

Thanks Drainy,
do you mean splunk will store the result somewhere or user stored search result?

If savedsearch is good for app then is it good to create some saved search and distribute with app in default/savedsearches.conf?