All Apps and Add-ons

Sideview Utils - additional Search " admin search *"

KarunK
Contributor

Hi,

My apps uses Sideview util and when it load one of my dashboard it will take too much time. When i checked the searches.log its doing and additional search (admin search *) before my actual dashboard search, which is taking too much time as it searched through all the index.

I believe this is bug. Could any one please help us in finding a workaround ? I am running latest version of the Sideview Util - version 5.

Thanks

Regards

0 Karma

sideview
SplunkTrust
SplunkTrust

This is most likely not a problem with Sideview Utils specifically, but just with how the modules are nested inside eachother. The new Sideview Utils (1.2.5), has a new docs page that tries to give an understanding of how modules work with eachother, and specifically where and when searches get dispatched.

In short, it's quite possible to create views where, because of how the modules are arranged, you dispatch one or more unwanted searches. And such unwanted searches are often the dreaded "*" searches over all time.

Please paste in the XML, or email it to me, and I'd be happy to take a look and find the problem for you.

0 Karma

sideview
SplunkTrust
SplunkTrust

NOTE: For anyone else who wants to understand how the Advanced XML really works, check out the "Introduction to the Advanced XML" documentation page in the latest Sideview Utils app. It's a dense page, but you will come away understanding the upstream/downstream concept, and more impressive, understanding why, when, how and where the UI dispatches searches in your views at runtime.

0 Karma

sideview
SplunkTrust
SplunkTrust

Go ahead and send me the XML (nick@sideviewapps.com) and I'll show you what to change -- I'll bet you anything that even the dispatch of your "inputlookup" search can be removed.

0 Karma

KarunK
Contributor

Hi Nick,

Thanks for the Response. Sorry for being so late to respond, was away. I have figured it out that this may not a be a bug but as you said because of the way modules are arranged. So i have to inserts a search which does a simple csvlookup. "search *" is no longer happening. Thanks for your help.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...