Hello all!
I'm implementing a search panel with 2 sideview pulldowns. First one is just made of 3 static options, that serve as arguments in the nested second pulldown module, which queries its values from a csv lookup input file, using a PostProcess module. The query for this inputlookup is:
| inputlookup file.csv | where fuente="source1" | fields nombre valor
This query is running fast as hell in the search app, as expected, as the csv itself is just a few rows with the following format:
fuente , nombre , valor source1 , Matricula , cot_carplate source1 , Nombre , cot_nombre source1 , Documentos , cot_id soruce2 , Numero pol , pol_pol
The view XML is the following:
<module name="Pulldown" layoutpanel="panel_row1_col1" autorun="True"> <param name="name">fuente</param> <param name="label">Fuente de datos:</param> <param name="float">left</param> <param name="staticOptions"> <list> <param name="label">Cotizaciones</param> <param name="value">source1</param> </list> <list> <param name="label">Polizas</param> <param name="value">source2</param> </list> <list> <param name="label">Siniestros</param> <param name="value">source3</param> </list> <list> <param name="label">Busqueda libre</param> <param name="value"></param> </list> </param>
<!-- Second pulldown list to select the search parameters to use. It depends on the first pulldown list -sourcetypes to search from-. Uses a static lookup csv table, which is searched in postProcess param using the previous pulldown result as argument -$fuente$-. The postprocess lookup returns labelnames and values for the search params valid for the selected sourcetype. In free text search, this part of the resultant seach query will be empty -->
<module name="Pulldown">
<param name="float">left</param>
<param name="name">valor</param>
<param name="label">Parametro de busqueda:</param>
<param name="postProcess">
<![CDATA[
| inputlookup file.csv | where fuente="$fuente$" | fields nombre valor
]]>
</param>
<param name="staticOptions"/>
<!-- Equal symbol to avoid issues in free text search (no sourcetype is specified in the first pulldown list). -->
<param name="template">$value$ =</param>
<param name="valueField">valor</param>
<param name="labelField">nombre</param
When I load this view, the second pulldown population through postProcess takes a lot of time (almost 7-8 seconds). I'm on the last Sideview Utils version on Splunk 5.0. Any idea of what could be the issue?
Thanks and regards!