First and foremost: maybe what I'm looking for isn't possible or I'm going down the wrong road, in which case, please enlighten me.
So say we have search:
index=my_index my_field1=* | timechart my_field2
I can add this search to a dashboard and make it so, that with a dropdown list I can select what my_field1 will be. So I can generate a result overall, or a specific selection of it.
Now this search takes a while, so I thought I'd schedule it. This works, but the substition is not scheduled. So in other words, if I use the result in the dashboard, my search result remains "my_field1=*", no matter the substition from the dropdown list.
Is there an easy way to schedule all possible outcomes for this search? (they are fixed, so a lookup table for the values is an option)
Or do I need to look at other mechanisms to speed up the search, and if so, which would that be?
Kind regards,
Herman
↧