All Apps and Add-ons

Sideview Utils - additional Search " admin search *"

KarunK
Contributor

Hi,

My apps uses Sideview util and when it load one of my dashboard it will take too much time. When i checked the searches.log its doing and additional search (admin search *) before my actual dashboard search, which is taking too much time as it searched through all the index.

I believe this is bug. Could any one please help us in finding a workaround ? I am running latest version of the Sideview Util - version 5.

Thanks

Regards

0 Karma

sideview
SplunkTrust
SplunkTrust

This is most likely not a problem with Sideview Utils specifically, but just with how the modules are nested inside eachother. The new Sideview Utils (1.2.5), has a new docs page that tries to give an understanding of how modules work with eachother, and specifically where and when searches get dispatched.

In short, it's quite possible to create views where, because of how the modules are arranged, you dispatch one or more unwanted searches. And such unwanted searches are often the dreaded "*" searches over all time.

Please paste in the XML, or email it to me, and I'd be happy to take a look and find the problem for you.

0 Karma

sideview
SplunkTrust
SplunkTrust

NOTE: For anyone else who wants to understand how the Advanced XML really works, check out the "Introduction to the Advanced XML" documentation page in the latest Sideview Utils app. It's a dense page, but you will come away understanding the upstream/downstream concept, and more impressive, understanding why, when, how and where the UI dispatches searches in your views at runtime.

0 Karma

sideview
SplunkTrust
SplunkTrust

Go ahead and send me the XML (nick@sideviewapps.com) and I'll show you what to change -- I'll bet you anything that even the dispatch of your "inputlookup" search can be removed.

0 Karma

KarunK
Contributor

Hi Nick,

Thanks for the Response. Sorry for being so late to respond, was away. I have figured it out that this may not a be a bug but as you said because of the way modules are arranged. So i have to inserts a search which does a simple csvlookup. "search *" is no longer happening. Thanks for your help.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...