The problem is that if I parse it out with a Rex AFTER I pull in the 2.5M records it takes 10s, if I can use a tag it take 1.5s.
I can certainly parse it, this is fundamentally a performance issue of not being able to put what I pass from the drilldown into the initial search criteria.
I could put a tag friendly label on the dashboard, but management is going to complain about it saying NewYork-NY or Rochester-MN instead of 'New York, NY'.
... View more
I have a trellis view where I break down my charts into Cities. The labels are something like 'Charlotte, NC'. I can make a drilldown to my details page using the form.city=$trellis.value$.
The problem is now I want to improve the performance on my target page. It currently is pulling data for all 100 of my cities then filtering by the city name using a lookup table to convert 'Chartlotte, NC' to 'clt' which I can then apply to a hostname filter.
index=data sourcetype=searchdata "string"
| eval fields=split(host, "."), market=mvindex(fields, 1)
| lookup sitemapping sitecode as market OUTPUT region, sitecity, sitecode
| search sitecity="Charlotte, NC"
What I would like to do is use tag::host="clt" so that I can filter the records in the initial search.
One option is to extract the code somehow from the Trellis, the other is to convert from the label to the code in my query before I do the search part.
I tried putting an inputlookup before the search, but that ends up filtering out all the data due to the results of the inputlookup.
| inputlookup market-mapping | search sitecity="Charlotte, NC" | fields sitecode
| search index=data sourcetype=searchdata "string" tag::host=sitecode
The inputlookup by itself returns 'clt' in the example. Running the search by itself returns my data
... View more