How to edit my filtering search using a select drop-down value to improve performance?

[lduchesne]

Dear All,

I have a small performance problem and I'd like to know if someone can help me. I have a basic dashboard with a dropdown populated from a query (everything works), to which I added a static option "ALL" with a value of *.

Let's say my field and token are both named "field1", when I select it, updates a graph in the same dashboard. The query I use for this graph is the following :

index=… source=…  field1=$field1$ | chart ...

This works, but is slow when I use the "ALL" static option, as it translates to :

index=… source=…  field1=* | chart ...

I did try the same search without the field1=* (which gives the same results) and it is very fast, so that's what I'm trying to achieve, when "ALL" is selected :

index=… source=… | chart ...

I tried a couple of ways but cannot find the right solution. I'm probably looking at something like this :

index=… source=…  (X OR field1=$field1$) | chart …

Where X would be some kind of condition that would render the expression always true but can't find the right syntax.

I also tried:
- setting the value to null, and having index=… source=… (isnull($field1$) OR field1="$field1$") | chart ...
- setting the value to true, and having index=… source=… ($field1$ OR field1="$field1$") | chart ...

Or maybe something else entirely?

Regards,
Laurent

[jhlopez]

Hi,

No idea why it is slower when putting field1=* in your search. It is supposedly same, based on my experience.

Anyways you can achieve your objective by trying the below guide:

On your dropdown box:
1. On "token Prefix" under "token options" input this: field1="
2. On "token suffix" under "token options" input this: "
3. Leave empty the value of "ALL" under static options.
4. Then click save.

On the search inside your panel:
index=… source=… $field1$ | chart ...

Cheers...

[lakhanlal]

It is working perfect !!