Monitoring Splunk

How to improve my apps performance

jangid
Builder

in my form based dashboard panel I am filling a drop down

<fieldset autoRun="true">
        <input type="time" searchWhenChanged="true">
            <default>Last 12 Hours</default>
        </input>
        <input type="dropdown" token="JT_JOB">
            <label>Select Job</label>
            <populatingSearch fieldForValue="JT_JOB" fieldForLabel="JT_JOB">
                <![CDATA[eventtype=counters_jt | table JT_JOB | dedup JT_JOB | sort JT_JOB ]]>
            </populatingSearch>
        </input>
</fieldset>

above search will take too much time based on my time criteria.
e.g. for last 12 hrs it'll take 15 to 20 seconds

the problem is I have more then 10 panels like this and this is big a pitfall for performance.

Is there any way to store this result and load this when my panel activate or any other alternate?

Thanks

Tags (1)
0 Karma
1 Solution

Drainy
Champion

Yes, save the search string as a saved search and use populatingSavedSearch instead;

Then you only need to enter the searchname and it will load the last scheduled search results

View solution in original post

Drainy
Champion

Yes, save the search string as a saved search and use populatingSavedSearch instead;

Then you only need to enter the searchname and it will load the last scheduled search results

Drainy
Champion

By the way, if this or other answers help you out then don't forget to click on the tick to the left 🙂 It just helps others out when searching for similar problems in the future.

0 Karma

Drainy
Champion

if there aren't any results from a scheduled search then the search will run on first load and store the results. Otherwise just use the fields as you normally would.

0 Karma

jangid
Builder

do you mean create a scheduled search and use here?

if yes then what about if I want to load this panel before schedule search, what about new field/value in search result?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...