I have a form dashboard in SimpleXML that has a searchTemplate
that references a saved search, but does some extra processing on top of it using a text input:
<searchTemplate>
| savedsearch "Fancy Accelerated Search"
| search area=$area$
| streamstats dc(object_id) as objects by date_wday type
</searchTemplate>
<fieldset>
<input type="text" token="area">
</input>
</fieldset>
This gives a distinct count over time, by day, for a specific "area" of objects. I then have charts that use searchPostProcess
to do some filtering and charting of the results from the saved search:
<searchPostProcess> where type="package" | timechart max(objects)</searchPostProcess>
And this gives a kind of sawtooth-pattern graph.
So the problem is that the search performed by the dashboard and triggering the search by clicking the magnifying glass in the bottom of the chart panel won't take the same amount of time. At all!
The search in the dashboard does not use the accelerated report from the searchTemplate, resulting in much slower searches. Triggering the search by clicking the magnifying glass and running that in the Search UI does use the summary (I've checked with the Job Inspector that a summary_id
was referenced).
I have heard back from Splunk Support about this.
This issue has been identified as SPL-88017: Report acceleration will not be used when post process search is used in the dashboard.
This bug has been resolved in development and the fix will be released in version 6.1.4.
Not long to go!!!
Edit 1st Oct 2014: I have just downloaded 6.1.4 and can confirm that report acceleration does now work with search templates.
I have heard back from Splunk Support about this.
This issue has been identified as SPL-88017: Report acceleration will not be used when post process search is used in the dashboard.
This bug has been resolved in development and the fix will be released in version 6.1.4.
Not long to go!!!
Edit 1st Oct 2014: I have just downloaded 6.1.4 and can confirm that report acceleration does now work with search templates.
Great news, thanks for letting me know! I'm still waiting for an answer from support for more than a month...
Hi @sajbutler, I have a support ticket opened for it but I have yet to hear back as to whether they confirm it as a bug or not. I think it is, I have a pretty clear reproducer for it...
Hi @laserval and @alexiri, I'm also experiencing the same issue, did you ever get to the bottom of it?
Hi @laserval, I'm seeing this exact same problem, did you ever figure out how to solve it? Did you open a support request about it?
Is your dashboard in the same app as the report acceleration?
Yes. I'm seeing the same effect with a different report and dashboard, as well.
Is your dashboard in the same app as the report acceleration?
Additionally, make sure both search strings really are identical in the search job inspector.
The search strings I write are identical, but I suspect they result in different searches when parsed by Splunk. What I'm wondering is if it's possible to use report acceleration for the searchTemplate
part of a form search, when having a postProcess
after it.
For debugging, take a look at the search job launched by your dashboard and compare it to the search job launched from the search UI. If a search is accelerated you'll see something like "using summary foo" at the top.
Additionally, make sure both search strings really are identical in the search job inspector.