How can I improve the performance of dropdown load on dashboards?

[egid_la]

I'm currently running Splunk 6.5.3

I created a form which is designed to present business codes based on an input multi select.

I used a search which returns results on last 24 hours but it slow.(~ 3000 business codes)

I tried to use the inputlookup command to retrieve the data instead of the current search but it still slow on last 24 hours. (~ 3000 business codes)

I guess it's related to the size because if i change time to 4 hours, it's faster.

How can i improve the performance of drop down load on dashboards?

[niketn]

@egid_la for community to assist you with performance tune your multi select you would need to provide your current search (with mocked up field names if required).

[egid_la]

| inputlookup business_codes.csv
| stats by PART
| table PART

business_codes

AXX
BXX
CXX
DXX
EXX
...
(~ 3000 results)

[niketn]

You are showing values as business_codes but stats and table use field as PART. Not sure which one is correct, but hoping you are interested in business_codes have you tried dedup command?

| inputlookup business_codes.csv 
| dedup business_codes 
| table business_codes 

[egid_la]

Yes excuse me,

| inputlookup business_codes.csv
| rename PART AS business_codes
| stats by business_codes
| table business_codes

business_codes
AXX
BXX
CXX
DXX
EXX
...
(~ 3000 results)

[egid_la]

Same result for dedup

[niketn]

How about the following:

| inputlookup business_codes.csv
| table PART
| dedup PART
| rename PART as business_codes

Here, rename is done after dedup.
You dont have to stress too much since you already have a solution that works 🙂

[egid_la]

Ok i know now thanks

[Runals · Accepted solution]

When you say you used a lookup command are you saying the query behind the multi select is doing | inputlookup .... ? I'd generally recommend having a scheduled search run that populates that lookup to keep it updated and query from there. This would make the process of finding the business codes much faster vs having to extract the information from the raw data. From what you mention though there could be an issue as the UI tries to iterate over the 3k options.

[egid_la]

Yes it's | inputlookup.
I tried scheduled search it's faster.
Thanks

[gcusello]

Hi egid_la,
when I have so many items I prefer to use a text box instead of dropdown.
Eventually putting *before and after input.

In this way there aren't problems in loading.
To have more performaces I suggest to use a lookup or a txidx file (txcollect).

Bye.
Giuseppe

[egid_la]

What do you mean by putting *before and after input ?
Thanks

[gcusello]

Hi egid_la,
to take a substring with * vefore and after, something like this:

<input type="text" token="filter">
  <label>Filter</label>
  <initialValue></initialValue>
  <prefix>*</prefix>
  <suffix>*</suffix>
</input>

Bye.
Giuseppe

[egid_la]

Hi cusello,

It's clear now

Bye