I've got some other questions on here out in regards to search performance, and several replies have mentioned "disabling preview" in order to speed up a search. People keep saying to "uncheck 'Preview'", but I cannot find this check box ANYWHERE in Splunk. What am I missing here? It's not an option when you go to edit a saved search, it's not an option that appears anywhere around the flashtimeline, it's not in the "Options" pop-up in the results area... nowhere. In addition, for scheduled searches that run on a cron, does this option need to be disabled somehow, or is it just disabled by default for background Splunk triggered searches? Please help, I'd really like to disable this option to see if it helps with performance the way they're claiming it will.
Thanks in advance.
This setting only appears on the
Statistics tab and is fairly persistent (meaning that if you turn it on at any point, it is likely to be on everywhere until you turn it off). So go to the
Statistics tab after running any search, and notice the
Preview menu directly below the
Statistics label. It has 2 options:
I believe that the recommendations were referring to the Preview checkbox in the Advanced Charting view.
Views->Advanced Charting, under the Results section.
You can also get to it in
flashtimeline, but only when using transformative commands like
stats. In that case, you have to first click for the Results Table display, then you can see it under Options.
If you are having performance issues, you may want to consider adding more hardware, improving disk layout for better I/O, or better yet contacting Splunk Support for assistance suited to your specific needs.
The thing is, after a long search finally completes (and this isn't a search that went through the Advanced Charting view at all), if you then inspect the search, the inspection window will show that "EnablePreview" was "true" for the search. Does this not incur any search penalty if not created through the Advanced Charting section? Alternatively, is it possible to append any search option to saved searches that will make sure this option is completely "off"? Thanks.