I have a form dashboard in SimpleXML that has a searchTemplate
that references a saved search, but does some extra processing on top of it using a text input:
<searchTemplate>
| savedsearch "Fancy Accelerated Search"
| search area=$area$
| streamstats dc(object_id) as objects by date_wday type
</searchTemplate>
<fieldset>
<input type="text" token="area">
</input>
</fieldset>
This gives a distinct count over time, by day, for a specific "area" of objects. I then have charts that use searchPostProcess
to do some filtering and charting of the results from the saved search:
<searchPostProcess> where type="package" | timechart max(objects)</searchPostProcess>
And this gives a kind of sawtooth-pattern graph.
So the problem is that the search performed by the dashboard and triggering the search by clicking the magnifying glass in the bottom of the chart panel won't take the same amount of time. At all!
The search in the dashboard does not use the accelerated report from the searchTemplate, resulting in much slower searches. Triggering the search by clicking the magnifying glass and running that in the Search UI does use the summary (I've checked with the Job Inspector that a summary_id
was referenced).
- Is it possible to use acceleration of a saved search in a searchTemplate with searchPostProcess?