How to use Report acceleration in dashboard without using post process method in Splunk?

[snehalk]

Hello All,

I have a dashboard which loads large amounts of data, hence its impacting performance dashboard, so to overcome that I decided to go with report acceleration, as given here link

But in dashboard it has multiple inputs, like drop down and text box, so for that if I use the post process then I am not getting export feature of Splunk.

So can anyone help me how I can achieve my goal? how to optimize dashboard performance?

Note: created schedule report which will run every day.

Thanks in Advance

[elliotproebstel]

If I understand correctly, you have a dashboard that you are populating by:
(1) Loading a saved report using a reference in your XML like <search ref="Named Search Report" />
(2) Using post-processing to incorporate input from a drop-down and a text box by passing tokens into the search query
But given that you are using post-processing, you aren't able to use export features of the dashboard.

If that's correct, you can try an alternative way of referencing the saved report. You will need to note the name of the report (you already have that), the app in which the report is saved, and the user who owns the report. Given those, go back into your dashboard and change that search element to remove the ref="Named Search Report". Start your search query with this:
| loadjob savedsearch="[user who owns the search]:[app name]:[report name]" and then append whatever you were using as your post-process search before.
Note that the [] brackets in that code sample are not meant to be included in your actual code. They represent the placeholders for the values.

[snehalk]

Hello elliotproebstel,
Thank you for response, but if i used loadjob command then the job will get expire soon, as i don't want to run saved search frequently, now we are running every day at specific time.

[elliotproebstel]

The loadjob command will not change the expiration date of the saved search. I use this approach in a dashboard to load the results of a report run once daily, and it has no impact on the expiration time of the report that was run in the early morning.