A little background:
I have been thinking of rewriting the searches to be base and post-processes. However as I have been reading about the changes needed in the dashboards when in the new environment, I have read some comments and articles where post-processing may not be suitable for multi-index sites. Doing that might be slower than saved searches.
Does anybody have any real-world experiences that they can share? I don't want to proceed down one path when the other might be better in the long run.
Post process search are inherently slower than individual. Typically I point people to post process searches when users or dashboards is maxing out system or user level concurrent searches. In short Post process search will always be slower, except for a very some set of cases.
Post process searches don't count against a user concurrency limit.
Slowness/performance of Post process search isn't well documented, but is a limitation/pitfall of using the technique. It commonly known among Splunk veterans. Not to say you cant optimize your base search to increase efficiency.
Here is some information on Post Processes. http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/Savedsearches#Post-process_searches.
Post from sideview utils (former Splunk Employee) third paragraph. https://answers.splunk.com/answers/85486/sideview-utils-postprocess-slow-speed-searchhead-or-indexer...
So I would suggest you to use saved searches
.
Well I got this answers from the below link:
https://answers.splunk.com/answers/473936/why-are-my-post-process-searches-running-slower-th.html
let me know if this helps!