Splunk Dev

Searches for hidden graphes are run

pduflot
Path Finder

Hello,

I have a dashboard where some graphes are hidden because they depend on a token that is not defined.
However, it seems that the searches that populate those graphes are still run. I see this because the number of access to the accelerated reports increased.
Can somebody confirm? If yes, How is it possible to prevent those searches to run? It slows down the display of the dashboard.

Basically I have:
2 base searches:
- NormalSearch
- ExtendedSearch

When the user goes to extended mode. All normal graphes are hidden and all extended graphes are shown.

Thanks!

0 Karma
1 Solution

woodcock
Esteemed Legend

Add a do-nothing reference to one of the tokens into each of the searches that do not have them. You can do this by postpending this to every search:

... | rename CommandPreventsThisSearchFromAutoRunningBeforeTokensAreSet AS $SomeToken$

View solution in original post

woodcock
Esteemed Legend

Add a do-nothing reference to one of the tokens into each of the searches that do not have them. You can do this by postpending this to every search:

... | rename CommandPreventsThisSearchFromAutoRunningBeforeTokensAreSet AS $SomeToken$

pduflot
Path Finder

Nice trick. Works well, thanks!

0 Karma
Get Updates on the Splunk Community!

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

Enterprise Security Content Update (ESCU) | New Releases

In April, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...