Quantcast
Viewing all articles
Browse latest Browse all 47296

Why is using base searches causing major performance issues on my dashboard?

Working on making dashboards to help report on activity. To make the dashboards as performant as possible, I'm using base searches. However, it appears that using base searches throughout a dashboard (1 search, but used in all the panels) almost causes an exponential increase in the size of the search - which causes the search to prematurely terminate. Doing a straight search for one of the panels got: *98,803 results, and took up 0.29 MB.* Just turning that 1 search into a 1 panel dashboard using a base search got same number of results, but took up **83.66 MB**. Which seems completely ridiculous. If I trim down results to just the last 2 weeks (instead of the last month), I get around 45,000 results, and the dashboard load only takes up 7MB. I'm trying to figure out if I'm doing something wrong? Or should I not use base queries at all - as they seem to constantly cause performance issues?? The dashboard:
AllAll-1mon@dnow
index=myIndex sourcetype=mySource $tenantid_tok$ NOT CrashReport NOT ErrorReport ("TYPE1" OR "TYPE2") | `expand_checkpoints` | fields - _raw | spath input=checkPoint output=eventName path=EventName | where match(eventName,"TYPE1") or match(eventName,"TYPE2") | spath input=checkPoint output=userId path=UserId | spath input=checkPoint output=tenantId path=TenantId | spath input=checkPoint output=eventTime path=EventTime | spath input=checkPoint output=metaData path=MetaData | spath input=metaData output=userType path=USER_TYPE | spath input=checkPoint output=deviceId path=DeviceId | spath input=checkPoint output=deviceModel path=DeviceModel | spath input=checkPoint output=deviceOS path=DeviceOS | spath input=checkPoint output=appVersion path=Version | eval deviceType=if(like(deviceOS,"Android%"),"Android","iOS") | eval fullUserName=userId+"@"+tenantId | fields - checkPoint | fields eventName,userId,tenantId,eventTime,metaData,userType,deviceId,deviceModel,deviceOS,appVersion,deviceType,fullUserName$date_tok.earliest$$date_tok.latest$UsersTotalchart dc(fullUserName)DevicesTotaldedup deviceId | chart count(deviceId)
-Thanks!

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>