Dashboards & Visualizations

Which is faster on a dashboard, post processing or using saved searches

randy_moore
Path Finder

A little background:

  • We have a single instance install now and are moving to a multisite index cluster and multisite SH cluster.
  • Our dashboards on the current single instance are 95% inline searches, with a few summary index panels and saved searches in the mix. Very small amount of those.
  • No real-time searches.
  • The dashboards have on average 15 panels that are refreshed every 2 minutes (and yes we need it refreshed that quickly).

I have been thinking of rewriting the searches to be base and post-processes. However as I have been reading about the changes needed in the dashboards when in the new environment, I have read some comments and articles where post-processing may not be suitable for multi-index sites. Doing that might be slower than saved searches.

Does anybody have any real-world experiences that they can share? I don't want to proceed down one path when the other might be better in the long run.

0 Karma

mayurr98
Super Champion

Post process search are inherently slower than individual. Typically I point people to post process searches when users or dashboards is maxing out system or user level concurrent searches. In short Post process search will always be slower, except for a very some set of cases.

Post process searches don't count against a user concurrency limit.
Slowness/performance of Post process search isn't well documented, but is a limitation/pitfall of using the technique. It commonly known among Splunk veterans. Not to say you cant optimize your base search to increase efficiency.

Here is some information on Post Processes. http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/Savedsearches#Post-process_searches.

Post from sideview utils (former Splunk Employee) third paragraph. https://answers.splunk.com/answers/85486/sideview-utils-postprocess-slow-speed-searchhead-or-indexer...

So I would suggest you to use saved searches.
Well I got this answers from the below link:
https://answers.splunk.com/answers/473936/why-are-my-post-process-searches-running-slower-th.html

let me know if this helps!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...