Splunk Search

How to stop running searches on hidden panels?

robertlynch2020
Motivator

Hi

I have a heavy dashboard, so i am trying to hide some panels. The idea is i have a check box that sets a token and the panel will display.
Then i want the panel to display + run search. However its running the search straight away, can i stop this?

The issues is the search is running when the dashboard is loading. This hangs the dashboard 5 seconds.

Checkbox set token

ON

This is the panel - it is heavy and the more data (Large time) the longer it takes to load. Ideally when someone clicks GANTT_CHART_ON, the time slice is 2 seconds. Then it loads quickly.

<panel depends="$TPS_ON_OFF$,$TPS_ON_ALL_PANELLS$,$GANTT_CHART_ON$">
      <title>TPS Real-Time Activity Gantt Chart: = $TPS_Class_token$</title>
      <viz type="timeline_app.timeline">
        <search>

                    <query>eventtype=mlc sourcetype=tps host=$host_token$ * | eval duration = endTime - startTime | search name = "*" operationIdentity=$TPS_Class_token$ | eval fullyQualifiedMethod = name."#".operationIdentity | sort - duration | table _time fullyQualifiedMethod duration </query>
          <earliest>$tps_selection.earliest$</earliest>
          <latest>$tps_selection.latest$</latest>
        </search>
        <option name="height">229</option>
        <option name="timeline_app.timeline.axisTimeFormat">SUBSECONDS</option>
        <option name="timeline_app.timeline.colorMode">categorical</option>
        <option name="timeline_app.timeline.maxColor">#DA5C5C</option>
        <option name="timeline_app.timeline.minColor">#FFE8E8</option>
        <option name="timeline_app.timeline.numOfBins">6</option>
        <option name="timeline_app.timeline.tooltipTimeFormat">SUBSECONDS</option>
        <option name="timeline_app.timeline.useColors">0</option>
        <drilldown>
          <set token="dummy">true</set>
        </drilldown>
      </viz>
    </panel>
1 Solution

ktugwell_splunk
Splunk Employee
Splunk Employee

Your search is meeting the token criteria before your depends clause

Try this:

eventtype=mlc sourcetype=tps host=$host_token$ *| eval foo="$TPS_ON_OFF$" | eval foo1="$TPS_ON_ALL_PANELLS$" | eval foo2="$GANTT_CHART_ON$" | eval duration = endTime - startTime | search name = "*" operationIdentity=$TPS_Class_token$ | eval fullyQualifiedMethod = name."#".operationIdentity | sort - duration | table _time fullyQualifiedMethod duration

Your search will then be "Waiting for input" until all of your depends tokens have been populated

View solution in original post

ktugwell_splunk
Splunk Employee
Splunk Employee

Your search is meeting the token criteria before your depends clause

Try this:

eventtype=mlc sourcetype=tps host=$host_token$ *| eval foo="$TPS_ON_OFF$" | eval foo1="$TPS_ON_ALL_PANELLS$" | eval foo2="$GANTT_CHART_ON$" | eval duration = endTime - startTime | search name = "*" operationIdentity=$TPS_Class_token$ | eval fullyQualifiedMethod = name."#".operationIdentity | sort - duration | table _time fullyQualifiedMethod duration

Your search will then be "Waiting for input" until all of your depends tokens have been populated

robertlynch2020
Motivator

Brilliant, thanks 🙂

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...