Hi,
I have a number of searches structured where I'm comparing again summary indexes and lookup tables or results I don't want. From the docs my searches are formatted like:
index=some_index NOT [search index=another_index | fields field_val]
where the summary index another_index is only updated once a day. These searches are used in my dashboards several times and seem to run very slowly. Is there a way to explicitly save sub search so that it doesn't have to be rerun? Or this done automatically?
You can saved the subsearch clause as a saved search and use them in your queries.
Saved Search : `
index=another_index | fields field_val
Updated dashboard searches
index=some_index NOT [|savedsearch savedSearchName]
Also, to improve performance, you can change your subquery from
index=another_index | fields field_val
to
index=another_index | stats count by field_val | fields - count
You can saved the subsearch clause as a saved search and use them in your queries.
Saved Search : `
index=another_index | fields field_val
Updated dashboard searches
index=some_index NOT [|savedsearch savedSearchName]
Also, to improve performance, you can change your subquery from
index=another_index | fields field_val
to
index=another_index | stats count by field_val | fields - count