Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Can a searchTemplate in a form use report acceleration?

$
0
0

I have a form dashboard in SimpleXML that has a searchTemplate that references a saved search, but does some extra processing on top of it using a text input:

<searchTemplate> 
    | savedsearch "Fancy Accelerated Search" 
    | search area=$area$ 
    | streamstats dc(object_id) as objects by date_wday type 
</searchTemplate>
<fieldset>
    <input type="text" token="area">
    </input>
</fieldset>

This gives a distinct count over time, by day, for a specific "area" of objects. I then have charts that use searchPostProcess to do some filtering and charting of the results from the saved search:

<searchPostProcess> where type="package" | timechart max(objects)</searchPostProcess>

And this gives a kind of sawtooth-pattern graph.

So the problem is that the search performed by the dashboard and triggering the search by clicking the magnifying glass in the bottom of the chart panel won't take the same amount of time. At all!

The search in the dashboard does not use the accelerated report from the searchTemplate, resulting in much slower searches. Triggering the search by clicking the magnifying glass and running that in the Search UI does use the summary (I've checked with the Job Inspector that a summary_id was referenced).

  • Is it possible to use acceleration of a saved search in a searchTemplate with searchPostProcess?

Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>