Monitoring Splunk

How to improve my apps performance

jangid
Builder

in my form based dashboard panel I am filling a drop down

<fieldset autoRun="true">
        <input type="time" searchWhenChanged="true">
            <default>Last 12 Hours</default>
        </input>
        <input type="dropdown" token="JT_JOB">
            <label>Select Job</label>
            <populatingSearch fieldForValue="JT_JOB" fieldForLabel="JT_JOB">
                <![CDATA[eventtype=counters_jt | table JT_JOB | dedup JT_JOB | sort JT_JOB ]]>
            </populatingSearch>
        </input>
</fieldset>

above search will take too much time based on my time criteria.
e.g. for last 12 hrs it'll take 15 to 20 seconds

the problem is I have more then 10 panels like this and this is big a pitfall for performance.

Is there any way to store this result and load this when my panel activate or any other alternate?

Thanks

Tags (1)
0 Karma
1 Solution

Drainy
Champion

Yes, save the search string as a saved search and use populatingSavedSearch instead;

Then you only need to enter the searchname and it will load the last scheduled search results

View solution in original post

Drainy
Champion

Yes, save the search string as a saved search and use populatingSavedSearch instead;

Then you only need to enter the searchname and it will load the last scheduled search results

Drainy
Champion

By the way, if this or other answers help you out then don't forget to click on the tick to the left 🙂 It just helps others out when searching for similar problems in the future.

0 Karma

Drainy
Champion

if there aren't any results from a scheduled search then the search will run on first load and store the results. Otherwise just use the fields as you normally would.

0 Karma

jangid
Builder

do you mean create a scheduled search and use here?

if yes then what about if I want to load this panel before schedule search, what about new field/value in search result?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Cisco Data Fabric from Architecture to Investigation, Better SOC Visibility, and More ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

The Trust Gap: Why a Data Foundation is Fundamental to an Agentic Enterprise

The Trust Gap: Why a data foundation is fundamental to an  Agentic Enterprise.   Agentic AI is transforming ...

Data Management Digest – September 2026

    Welcome to the September 2026 edition of Data Management Digest! September brought a fresh wave of ...