Hi,
I have a dashboard where one of the panels is generated from a |loadjob command which produces a table.
This part works as normal.
Now, I need to add an extra column onto the panel's table and as a result, I need to incorporate another index onto the panel's query. As result, the panel's query has both the |loadjob and also an appendcols piece that searches an index.
The extra clause is as follows:
| appendcols [search index=fraud_glassbox sourcetype="gb:sessions"
| stats count as email_count by Global_EmailID_CSH
| eval score_email = case(email_count<2, 40, 1=1, 100) ]
The issue is .... my dashboard SIGNIFICANTLY slows down in how the results are generated on the dashboard.
Why would this be? Would I need an alterative to appendcols command?
Many thanks,
It probably slows down because you are doing an additional search - if you are using load job for the first part of the search, have you considered using load job for the appendcols part of the search too?