Splunk Dev

Searches for hidden graphes are run

pduflot
Path Finder

Hello,

I have a dashboard where some graphes are hidden because they depend on a token that is not defined.
However, it seems that the searches that populate those graphes are still run. I see this because the number of access to the accelerated reports increased.
Can somebody confirm? If yes, How is it possible to prevent those searches to run? It slows down the display of the dashboard.

Basically I have:
2 base searches:
- NormalSearch
- ExtendedSearch

When the user goes to extended mode. All normal graphes are hidden and all extended graphes are shown.

Thanks!

0 Karma
1 Solution

woodcock
Esteemed Legend

Add a do-nothing reference to one of the tokens into each of the searches that do not have them. You can do this by postpending this to every search:

... | rename CommandPreventsThisSearchFromAutoRunningBeforeTokensAreSet AS $SomeToken$

View solution in original post

woodcock
Esteemed Legend

Add a do-nothing reference to one of the tokens into each of the searches that do not have them. You can do this by postpending this to every search:

... | rename CommandPreventsThisSearchFromAutoRunningBeforeTokensAreSet AS $SomeToken$

pduflot
Path Finder

Nice trick. Works well, thanks!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...