Splunk Search

How to edit my filtering search using a select drop-down value to improve performance?

lduchesne
Engager

Dear All,

I have a small performance problem and I'd like to know if someone can help me. I have a basic dashboard with a dropdown populated from a query (everything works), to which I added a static option "ALL" with a value of *.

Let's say my field and token are both named "field1", when I select it, updates a graph in the same dashboard. The query I use for this graph is the following :

index=… source=…  field1=$field1$ | chart ...

This works, but is slow when I use the "ALL" static option, as it translates to :

index=… source=…  field1=* | chart ...

I did try the same search without the field1=* (which gives the same results) and it is very fast, so that's what I'm trying to achieve, when "ALL" is selected :

index=… source=… | chart ...

I tried a couple of ways but cannot find the right solution. I'm probably looking at something like this :

index=… source=…  (X OR field1=$field1$) | chart …

Where X would be some kind of condition that would render the expression always true but can't find the right syntax.

I also tried:
- setting the value to null, and having index=… source=… (isnull($field1$) OR field1="$field1$") | chart ...
- setting the value to true, and having index=… source=… ($field1$ OR field1="$field1$") | chart ...

Or maybe something else entirely?

Regards,
Laurent

jhlopez
Explorer

Hi,

No idea why it is slower when putting field1=* in your search. It is supposedly same, based on my experience.

Anyways you can achieve your objective by trying the below guide:

On your dropdown box:
1. On "token Prefix" under "token options" input this: field1="
2. On "token suffix" under "token options" input this: "
3. Leave empty the value of "ALL" under static options.
4. Then click save.

On the search inside your panel:
index=… source=… $field1$ | chart ...

Cheers...

lakhanlal
Engager

It is working perfect !!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...