Splunk Enterprise

help on post process search

jip31
Motivator

hello

I use a dashboard with different post process search because I reuse the same index and the same sourcetype

 

  <search id="erreur">
    <query>index=toto` sourcetype=tutu:web:error site=$site$ 
| fields web_error_count 
</query>
    <earliest>$date.earliest$</earliest>
    <latest>$date.latest$</latest>
  </search>
 <search base="erreur">
          <query>| stats sum(web_error_count) as web_error_count 
| appendpipe 
    [ stats count as _events 
    | where _events = 0 
    | eval web_errr_count = 0 ]</query>

 

But sometimes I need to use the same index and the same sourcetype only one time

So, in this case I use an inline search in the dashboard

What I need to know is about the performances

Is it better to use a post process search or an inline search when we dont have to reuse a specific sourcetype?

And when I have 2 inline search with the same index and 2 different sourcetype, is it better to use a post proces search like this

  <search id="test">
    <query>index=toto` sourcetype=tutu:web:error OR sourcetype=titi:url) site=$site$ 
| fields web_error_count 
</query>
    <earliest>$date.earliest$</earliest>
    <latest>$date.latest$</latest>
  </search>

Thanks

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

It depends on your data - use the job inspector to see how your searches perform doing it different ways and choose the best way for you.

Having said that, there are a couple of techniques you could use which may help. You could schedule reports to run and reference the results in your dashboard. You could store the search id of the base searches and use loadjob to retrieve the results in other searches.

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It depends on your data - use the job inspector to see how your searches perform doing it different ways and choose the best way for you.

Having said that, there are a couple of techniques you could use which may help. You could schedule reports to run and reference the results in your dashboard. You could store the search id of the base searches and use loadjob to retrieve the results in other searches.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

You must also remember that with base searches you should use transforming command on base search or otherwise there is a big risk that your result set is too big (500k) and it ignore some results. You could found more here Use a transforming base search

IMHO: if you have only one search then I prefer to use it as inline. It's much easier handle that way and there is not that previous limitation.

r. Ismo

0 Karma

jip31
Motivator

thanks

I know for scheduled reports but it is not what I need because I need to have the last results when I open the dashboard

So i am going to compare performances with the job inspector

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...