Splunk Search

How to stop running searches on hidden panels?

robertlynch2020
Motivator

Hi

I have a heavy dashboard, so i am trying to hide some panels. The idea is i have a check box that sets a token and the panel will display.
Then i want the panel to display + run search. However its running the search straight away, can i stop this?

The issues is the search is running when the dashboard is loading. This hangs the dashboard 5 seconds.

Checkbox set token

ON

This is the panel - it is heavy and the more data (Large time) the longer it takes to load. Ideally when someone clicks GANTT_CHART_ON, the time slice is 2 seconds. Then it loads quickly.

<panel depends="$TPS_ON_OFF$,$TPS_ON_ALL_PANELLS$,$GANTT_CHART_ON$">
      <title>TPS Real-Time Activity Gantt Chart: = $TPS_Class_token$</title>
      <viz type="timeline_app.timeline">
        <search>

                    <query>eventtype=mlc sourcetype=tps host=$host_token$ * | eval duration = endTime - startTime | search name = "*" operationIdentity=$TPS_Class_token$ | eval fullyQualifiedMethod = name."#".operationIdentity | sort - duration | table _time fullyQualifiedMethod duration </query>
          <earliest>$tps_selection.earliest$</earliest>
          <latest>$tps_selection.latest$</latest>
        </search>
        <option name="height">229</option>
        <option name="timeline_app.timeline.axisTimeFormat">SUBSECONDS</option>
        <option name="timeline_app.timeline.colorMode">categorical</option>
        <option name="timeline_app.timeline.maxColor">#DA5C5C</option>
        <option name="timeline_app.timeline.minColor">#FFE8E8</option>
        <option name="timeline_app.timeline.numOfBins">6</option>
        <option name="timeline_app.timeline.tooltipTimeFormat">SUBSECONDS</option>
        <option name="timeline_app.timeline.useColors">0</option>
        <drilldown>
          <set token="dummy">true</set>
        </drilldown>
      </viz>
    </panel>
1 Solution

ktugwell_splunk
Splunk Employee
Splunk Employee

Your search is meeting the token criteria before your depends clause

Try this:

eventtype=mlc sourcetype=tps host=$host_token$ *| eval foo="$TPS_ON_OFF$" | eval foo1="$TPS_ON_ALL_PANELLS$" | eval foo2="$GANTT_CHART_ON$" | eval duration = endTime - startTime | search name = "*" operationIdentity=$TPS_Class_token$ | eval fullyQualifiedMethod = name."#".operationIdentity | sort - duration | table _time fullyQualifiedMethod duration

Your search will then be "Waiting for input" until all of your depends tokens have been populated

View solution in original post

ktugwell_splunk
Splunk Employee
Splunk Employee

Your search is meeting the token criteria before your depends clause

Try this:

eventtype=mlc sourcetype=tps host=$host_token$ *| eval foo="$TPS_ON_OFF$" | eval foo1="$TPS_ON_ALL_PANELLS$" | eval foo2="$GANTT_CHART_ON$" | eval duration = endTime - startTime | search name = "*" operationIdentity=$TPS_Class_token$ | eval fullyQualifiedMethod = name."#".operationIdentity | sort - duration | table _time fullyQualifiedMethod duration

Your search will then be "Waiting for input" until all of your depends tokens have been populated

robertlynch2020
Motivator

Brilliant, thanks 🙂

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...