Schedule report with variable field

[splunkuzleuven]

First and foremost: maybe what I'm looking for isn't possible or I'm going down the wrong road, in which case, please enlighten me.

So say we have search:

index=my_index my_field1=* | timechart my_field2

I can add this search to a dashboard and make it so, that with a dropdown list I can select what my_field1 will be. So I can generate a result overall, or a specific selection of it.
Now this search takes a while, so I thought I'd schedule it. This works, but the substition is not scheduled. So in other words, if I use the result in the dashboard, my search result remains "my_field1=*", no matter the substition from the dropdown list.

Is there an easy way to schedule all possible outcomes for this search? (they are fixed, so a lookup table for the values is an option)
Or do I need to look at other mechanisms to speed up the search, and if so, which would that be?

Kind regards,
Herman

[gcusello · Accepted solution]

Hi splunkuzleuven,
you should use summary indexes:

• schedule your search choosing a time period and a span adeguate to your needs;
• add to you search the row | collect index=my_summary ;
• then use the new summary index for your searches as a database table.

the search to schedule (e.g. every hour) will be something like this:

index=my_index my_field1=* earliest=-h@h latest=@h
| timechart count BY my_field2 span=1h
| collect index=my_summary

then you can run something like this:

index=my_summary earliest=7d latest=now
| timechart sum(count) AS Total BY $my_token$

In this way you can use in your dashboard the results of your report (your scheduled search) that's very quick and you can pass tokens to it.

Analyze the collect command to understand if there are any additional options useful for you.

Bye.
Giuseppe