Really slow query in dashboard, same query runs fine through search app

[justjosh]

I have been using a dashboard containing multiple panels in a custom Splunk app with great success.

Up until now, the panels all had their own searches but they all queried the same index.

I recently setup another index as I wanted to include stats from a different datasource.

Any panel that I setup that queries the different datasource is extremely slow (several minutes to complete)

I have tested running the same query through the standard search app and the query returns within a few seconds.

Does anyone have ideas why the same query runs fine through the search app, but not through a dashboard panel in a custom app?

[Ayn]

While I don't have a direct answer, my suggestion is that you use the job inspector that can give you answers to exactly these kinds of questions. After you've run the query that seems to be running slowly, open up the Jobs page (up to the right) and choose to inspect the search in question. You'll get complete info about what the search looks like in the end (so you can try the exact same search by yourself) and how the time was spent in the search process.