Hi!
I have a dashboard with 4 panels. I use a base search "baseSearch1" and two post process searches based on my baseSearch1 :
baseSearch1 -> countSearch
baseSearch1 -> tableSearch
| loadjob savedsearch="xx:yy:REPORT"
$optionalSearch$
| search element = $element$
| lookup lookup.csv ...
| eval delta = now() - _time
| eval STATUS = if(STATUS = "InProgress" AND delta > duration, "Warning", STATUS)
$date_filter.earliest$
$date_filter.latest$
| append [
| loadjob savedsearch="xx:yy:SUB_REPORT"
| search [search
index=my_index AND
element = $element$ source IN (source1, source2)
latest=$date_filter.latest$
earliest=$date_filter.earliest$
| fields element
] $optionalSearch$
| search element = $element$
]
| stats last(*) as * by element = $element$
| search [
search index=my_index AND
element = $element$
source IN (source1,source2)
latest=$date_filter.latest$
earliest=$date_filter.earliest$
| fields element
] $optionalSearch$
| search element = $element$
]
| chart first(STATUS) by flow, element useother=f limit=0
| sort flow
| transpose 10 column_name=element header_field=flow
| join element [
| loadjob savedsearch="xx:yy:REPORT_DETAIL"
]
Then my panels use these two searches to make some last transformations. When doing so, it turns out that my search lasts much longer than without using base searches (4x longer). It stays stuck on "Waiting for data" for about 30 seconds...
Would someone be able to explain how this is possible ? What could cause this problem ?
Thank you by advance for your help !
... View more