I have a small performance problem and I'd like to know if someone can help me. I have a basic dashboard with a dropdown populated from a query (everything works), to which I added a static option "ALL" with a value of *.
Let's say my field and token are both named "field1", when I select it, updates a graph in the same dashboard. The query I use for this graph is the following :
index=… source=… field1=$field1$ | chart ...
This works, but is slow when I use the "ALL" static option, as it translates to :
index=… source=… field1=* | chart ...
I did try the same search without the field1=* (which gives the same results) and it is very fast, so that's what I'm trying to achieve, when "ALL" is selected :
index=… source=… | chart ...
I tried a couple of ways but cannot find the right solution. I'm probably looking at something like this :
index=… source=… (X OR field1=$field1$) | chart …
Where X would be some kind of condition that would render the expression always true but can't find the right syntax.
I also tried:
- setting the value to null, and having index=… source=… (isnull($field1$) OR field1="$field1$") | chart ...
- setting the value to true, and having index=… source=… ($field1$ OR field1="$field1$") | chart ...
Or maybe something else entirely?
No idea why it is slower when putting field1=* in your search. It is supposedly same, based on my experience.
Anyways you can achieve your objective by trying the below guide:
On your dropdown box:
1. On "token Prefix" under "token options" input this: field1="
2. On "token suffix" under "token options" input this: "
3. Leave empty the value of "ALL" under static options.
4. Then click save.
On the search inside your panel:
index=… source=… $field1$ | chart ...