I'm building a BI analytics app and am trying to do as much caching as possible because of the huge volume of data that each report has to run against (roughly 350MB and upwards of 200,000-300,000 events per search).
Unfortunately, almost every report has at least one swappable parameter - multi-select pulldowns, single-select pulldowns, text search fields, etc., created using Sideview - that needs to swap into the searches. Example:
index="my_index" $selectedToken$
The default for "$selectedToken$" is nothing/empty/null, so the default search that returns when you load the report would be:
index="my_index"
Then you can select something from a pulldown that will rerun the search with "$selectedToken$" populated, e.g.:
index="my_index" host="my_host"
I know if I try to run the search with the Sideview token swap tag in place in the search app (not swapped out for some real value/string), I'll get zero results, so a saved search with the token swap tags will always return no results. The sheer number of possible combinations for the various tokens make it impossible to create a saved search for every combination.
Is it possible to save the default search so that the default view will load the saved search very rapidly, then revert to real-time searching when the user selects something from one of the tokens? If that's possible, how is it accomplished?