Quantcast
Viewing all articles
Browse latest Browse all 13053

Sideview Utils PostProcess and local csv inputlookup too slow!

Hello all!

I'm implementing a search panel with 2 sideview pulldowns. First one is just made of 3 static options, that serve as arguments in the nested second pulldown module, which queries its values from a csv lookup input file, using a PostProcess module. The query for this inputlookup is:

| inputlookup file.csv | where fuente="source1" | fields nombre valor

This query is running fast as hell in the search app, as expected, as the csv itself is just a few rows with the following format:

fuente , nombre , valor source1 , Matricula , cot_carplate source1 , Nombre , cot_nombre source1 , Documentos , cot_id soruce2 , Numero pol , pol_pol

The view XML is the following:

<module name="Pulldown" layoutpanel="panel_row1_col1" autorun="True"> <param name="name">fuente</param> <param name="label">Fuente de datos:</param> <param name="float">left</param> <param name="staticOptions"> <list> <param name="label">Cotizaciones</param> <param name="value">source1</param> </list> <list> <param name="label">Polizas</param> <param name="value">source2</param> </list> <list> <param name="label">Siniestros</param> <param name="value">source3</param> </list> <list> <param name="label">Busqueda libre</param> <param name="value"></param> </list> </param>

<!-- Second pulldown list to select the search parameters to use. It depends on the first pulldown list -sourcetypes to search from-. Uses a static lookup csv table, which is searched in postProcess param using the previous pulldown result as argument -$fuente$-. The postprocess lookup returns labelnames and values for the search params valid for the selected sourcetype. In free text search, this part of the resultant seach query will be empty -->
<module name="Pulldown">
 <param name="float">left</param>
 <param name="name">valor</param>
 <param name="label">Parametro de busqueda:</param>

 <param name="postProcess">
    <![CDATA[
     | inputlookup file.csv | where fuente="$fuente$" | fields nombre valor 
    ]]>
 </param>
 <param name="staticOptions"/>

 <!-- Equal symbol to avoid issues in free text search (no sourcetype is specified in the first pulldown list). -->
 <param name="template">$value$ =</param>
 <param name="valueField">valor</param>
 <param name="labelField">nombre</param

When I load this view, the second pulldown population through postProcess takes a lot of time (almost 7-8 seconds). I'm on the last Sideview Utils version on Splunk 5.0. Any idea of what could be the issue?

Thanks and regards!


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>