Why is using loadjob command (using sid) slower than create a new search query?

[karn]

Hello,

I created a dashboard with a table and multiple charts. After the table query is finished, I create a token ($job.sid$).

Then, I use this token for the other charts (loadjob command). I noticed that after the table loads completely, the charts begin loading data. Sometimes the charts load quickly, and sometimes they load very slowly.

After changing the charts to use the full query instead, they always load quickly. Why is that? I thought that loading data from the table and using it in the charts would be better.

[PickleRick · Accepted solution]

As with any such generic question about Splunk there are many "it depends" factors in the answer.

There are many possible causes for slower response. Most importantly, your environment may be full to the brim with searches and have to wait for a free slot for a search. Or your user's role might have hit their job concurrency limitations. Or (I assume it's not your case if you're spawning the search from the same dashboard you're later trying to use it from but it's a general answer) you might be doing loadjob from the SHC member which doesn't have the artifacts from the previously run search and they have to be replicated from another member.

There is a lot going on underneath 🙂