Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Why is using base searches causing major performance issues on my dashboard?

$
0
0
Working on making dashboards to help report on activity. To make the dashboards as performant as possible, I'm using base searches. However, it appears that using base searches throughout a dashboard (1 search, but used in all the panels) almost causes an exponential increase in the size of the search - which causes the search to prematurely terminate. Doing a straight search for one of the panels got: *98,803 results, and took up 0.29 MB.* Just turning that 1 search into a 1 panel dashboard using a base search got same number of results, but took up **83.66 MB**. Which seems completely ridiculous. If I trim down results to just the last 2 weeks (instead of the last month), I get around 45,000 results, and the dashboard load only takes up 7MB. I'm trying to figure out if I'm doing something wrong? Or should I not use base queries at all - as they seem to constantly cause performance issues?? The dashboard:
AllAll-1mon@dnow
index=myIndex sourcetype=mySource $tenantid_tok$ NOT CrashReport NOT ErrorReport ("TYPE1" OR "TYPE2") | `expand_checkpoints` | fields - _raw | spath input=checkPoint output=eventName path=EventName | where match(eventName,"TYPE1") or match(eventName,"TYPE2") | spath input=checkPoint output=userId path=UserId | spath input=checkPoint output=tenantId path=TenantId | spath input=checkPoint output=eventTime path=EventTime | spath input=checkPoint output=metaData path=MetaData | spath input=metaData output=userType path=USER_TYPE | spath input=checkPoint output=deviceId path=DeviceId | spath input=checkPoint output=deviceModel path=DeviceModel | spath input=checkPoint output=deviceOS path=DeviceOS | spath input=checkPoint output=appVersion path=Version | eval deviceType=if(like(deviceOS,"Android%"),"Android","iOS") | eval fullUserName=userId+"@"+tenantId | fields - checkPoint | fields eventName,userId,tenantId,eventTime,metaData,userType,deviceId,deviceModel,deviceOS,appVersion,deviceType,fullUserName$date_tok.earliest$$date_tok.latest$UsersTotalchart dc(fullUserName)DevicesTotaldedup deviceId | chart count(deviceId)
-Thanks!

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>